How to make sure I am receiving CPU or memory information from my Splunk server?

[antonovfr]

Hi everyone,

I just started with Splunk and I am doing some testing on this software.

I have previously used Elasticsearch so I have some basic understanding of the way Splunk works.

I have a Splunk server installed on an Ubuntu VM. My Windows host is sending logs via a universal forwarder.

I would like to display and search performance informations on the Splunk server. So I went in add data, I choose my host, then host performance monitoring (translation from french) then I choose % User Time in processor, give a Test2 name, choose the "*" instance and set the interval to 10 sec. I then choose the default index.

But then I don't know where to read those information. It doesn't appear in the Search and Reporting app.

Thanks in advance for your help.

[koshyk · Accepted solution]

The best way to tackle this is (rather than you writing everything from scratch)
- In your Windows remote machine , collect the performance metrics by adding the Perfmon Stanza as per this link to your UF
- Ensure correct indexes are present in your Splunk Enterprise while collecting them
- Ensure you install Splunk_TA_windows which does all the hard-work for you (normalising, field extraction etc.)
- Then install the Splunk App for Windows Infrastructure which will give you all dashboards and searches

[rmanrique]

But I have this problem...

https://community.splunk.com/t5/All-Apps-and-Add-ons/Windows-Add-on-Perfmon-not-working/m-p/506751#M...

[antonovfr]

Thanks a lot. I needed to add the perfmon Stanza in the config file of my universal forwarder