Getting Data In
Highlighted

List of valid [perfmon://] stanzas for inputs.conf

Path Finder

Hi,

I'm trying to configure performance monitoring inputs on a Windows universal forwarder, to send to a Linux indexer, by modifying inputs.conf as per:

http://docs.splunk.com/Documentation/Splunk/5.0.1/Data/Real-timeWindowsperformancemonitoring#Configu...

So far, I've only managed to find a few valid performance objects for the [perfmon://] stanzas by searching in Splunk Answers.

Does anyone know if there's a list of valid performance objects we can use in [perfmon://] stanzas in inputs.conf?

Thanks!

0 Karma
Highlighted

Re: List of valid [perfmon://] stanzas for inputs.conf

Splunk Employee
Splunk Employee

A full list of objects and counters is dependent on what software and services are installed on the target system. The best way to determine what counters are available is to install Splunk on the system, then configure Perfmon or WMI through the Splunk UI. For instance, in "Manager-->Data Inputs-->Local Performance...", you can select from a list of all available objects in a drop-down, then receive a list of available counters for the selected object.

View solution in original post

Highlighted

Re: List of valid [perfmon://] stanzas for inputs.conf

Path Finder

Hi Ron,

Thanks for your answer. I actually installed the Windows version of Splunk on a VM, and tried adding a data input for performance monitoring. From there I was able to determine what objects and counters I could use. It would be nice to have a documented list for easy reference when modifying configuration files, that's all.

0 Karma
Highlighted

Re: List of valid [perfmon://] stanzas for inputs.conf

Path Finder

An old question, but not an answer here that I like.

Per http://serverfault.com/questions/149816/easiest-way-to-get-perfmon-counter-names-into-a-text-file you can use the "typeperf.exe -q" (or -qx) command.

But as Ron said, the counters you get are dependent on what software is installed (and/or running) on the system. For example, when you install the .NET CLR, the counters for ".NET CLR Data()\SqlClient: ." are added. If you specify this in inputs.conf on a server that doesn't have the .NET CLR, you (obviously) won't get any data from that counter.

--Joe

0 Karma
Highlighted

Re: List of valid [perfmon://] stanzas for inputs.conf

Explorer

What I usually do is just put "counters = *" in the perfmon and let that run for 5-10 minutes, then just go search in splunk for that index, host, and object and see what counters it threw.

0 Karma