Getting Data In

How to make sure I am receiving CPU or memory information from my Splunk server?

New Member

Hi everyone,

I just started with Splunk and I am doing some testing on this software.

I have previously used Elasticsearch so I have some basic understanding of the way Splunk works.

I have a Splunk server installed on an Ubuntu VM. My Windows host is sending logs via a universal forwarder.

I would like to display and search performance informations on the Splunk server. So I went in add data, I choose my host, then host performance monitoring (translation from french) then I choose % User Time in processor, give a Test2 name, choose the "*" instance and set the interval to 10 sec. I then choose the default index.

But then I don't know where to read those information. It doesn't appear in the Search and Reporting app.

Thanks in advance for your help.

0 Karma
1 Solution

Super Champion

The best way to tackle this is (rather than you writing everything from scratch)
- In your Windows remote machine , collect the performance metrics by adding the Perfmon Stanza as per this link to your UF
- Ensure correct indexes are present in your Splunk Enterprise while collecting them
- Ensure you install SplunkTAwindows which does all the hard-work for you (normalising, field extraction etc.)
- Then install the Splunk App for Windows Infrastructure which will give you all dashboards and searches

View solution in original post

Super Champion

The best way to tackle this is (rather than you writing everything from scratch)
- In your Windows remote machine , collect the performance metrics by adding the Perfmon Stanza as per this link to your UF
- Ensure correct indexes are present in your Splunk Enterprise while collecting them
- Ensure you install SplunkTAwindows which does all the hard-work for you (normalising, field extraction etc.)
- Then install the Splunk App for Windows Infrastructure which will give you all dashboards and searches

View solution in original post

Path Finder
0 Karma

New Member

Thanks a lot. I needed to add the perfmon Stanza in the config file of my universal forwarder

0 Karma