Getting Data In

Memory and cpu usage does'nt update via WMI but Application and security logs are coming

mnaina
Explorer

I tried to get the logs from the remote computer by using the universal forwarder.

While installing the universal forwarder I checked Windows Application, Windows System, Memory and CPU.

But I can receive only Application and security logs, Memory and CPU are not coming to the splunk server.

I also checked the local database(metric file) where splunk universal forwarder is installed, metric file contains all logs including Memory and CPU, but the forwarder can send only Application and security logs.

Anybody knows what to do....

Thanks in Advance

sunrise
Contributor

I think that universal forwarder perfmon configurations in installing is not worked at ver.5.0.1.
So I set inputs.conf directly like below (using perfmon, not wmi), and restart universal forwarder, it worked.

[perfmon://Memory]
counters = % Committed Bytes In Use;Available MBytes;Committed Bytes
disabled = 0
interval = 600
object = Memory

Try it.

0 Karma
Get Updates on the Splunk Community!

Splunk MCP & Agentic AI: Machine Data Without Limits

  Discover how the Splunk Model Context Protocol (MCP) Server can revolutionize the way your organization ...

Finding Based Detections General Availability

Overview  We’ve come a long way, folks, but here in Enterprise Security 8.4 I’m happy to announce Finding ...

Get Your Hands Dirty (and Your Shoes Comfy): The Splunk Experience

Hands-On Learning and Technical Seminars  Sometimes, you just need to see the code. For those looking for a ...