Getting Data In

Memory and cpu usage does'nt update via WMI but Application and security logs are coming

mnaina
Explorer

I tried to get the logs from the remote computer by using the universal forwarder.

While installing the universal forwarder I checked Windows Application, Windows System, Memory and CPU.

But I can receive only Application and security logs, Memory and CPU are not coming to the splunk server.

I also checked the local database(metric file) where splunk universal forwarder is installed, metric file contains all logs including Memory and CPU, but the forwarder can send only Application and security logs.

Anybody knows what to do....

Thanks in Advance

sunrise
Contributor

I think that universal forwarder perfmon configurations in installing is not worked at ver.5.0.1.
So I set inputs.conf directly like below (using perfmon, not wmi), and restart universal forwarder, it worked.

[perfmon://Memory]
counters = % Committed Bytes In Use;Available MBytes;Committed Bytes
disabled = 0
interval = 600
object = Memory

Try it.

0 Karma
Got questions? Get answers!

Join the Splunk Community Slack to learn, troubleshoot, and make connections with fellow Splunk practitioners in real time!

Meet up IRL or virtually!

Join Splunk User Groups to connect and learn in-person by region or remotely by topic or industry.

Get Updates on the Splunk Community!

(re)Introducing the Splunk Community Champions + 2026 – 2027 Splunk MVPs ...

This program exists as a channel to empower and recognize Splunk advocates and help supercharge initiatives to ...

Introducing the 2026 - 2027 SplunkTrust cohort!

The goal of the SplunkTrust™ membership has historically been to acknowledge and recognize those who go above ...

Pro Tips for .conf26: How to Prep Like a Splunk Veteran

There’s no shortage of incredible content lined up for .conf26 in Denver, from deep-dive technical sessions ...