Getting Data In

Memory and cpu usage does'nt update via WMI but Application and security logs are coming

mnaina
Explorer

I tried to get the logs from the remote computer by using the universal forwarder.

While installing the universal forwarder I checked Windows Application, Windows System, Memory and CPU.

But I can receive only Application and security logs, Memory and CPU are not coming to the splunk server.

I also checked the local database(metric file) where splunk universal forwarder is installed, metric file contains all logs including Memory and CPU, but the forwarder can send only Application and security logs.

Anybody knows what to do....

Thanks in Advance

sunrise
Contributor

I think that universal forwarder perfmon configurations in installing is not worked at ver.5.0.1.
So I set inputs.conf directly like below (using perfmon, not wmi), and restart universal forwarder, it worked.

[perfmon://Memory]
counters = % Committed Bytes In Use;Available MBytes;Committed Bytes
disabled = 0
interval = 600
object = Memory

Try it.

0 Karma
Get Updates on the Splunk Community!

Index This | What is broken 80% of the time by February?

December 2025 Edition   Hayyy Splunk Education Enthusiasts and the Eternally Curious!    We’re back with this ...

Unlock Faster Time-to-Value on Edge and Ingest Processor with New SPL2 Pipeline ...

Hello Splunk Community,   We're thrilled to share an exciting update that will help you manage your data more ...

Splunk MCP & Agentic AI: Machine Data Without Limits

Discover how the Splunk Model Context Protocol (MCP) Server can revolutionize the way your organization uses ...