Getting Data In

Monitor HDD free space on windows systems


Hello, I am using single Splunk Enterprise instance on Windows server to collect data on TCP/IP port and monitor csv log files.
The server is an active directory member.

I would like to extend the functionality to monitor free space (in %) on client windows 7 machines (ca 150 hosts), also active directory members, all logged with same domain user.

I am confused from Splunk documentation, which all steps I should perform.

Is it necessary to install universal forwarder on each host?
Is it necessary to install additional Splunk for Windows app?

Seems to be more complicated than I expected.

For me it would be enough to to send the information once after login (part of the login script).

How do you collect the data from Windows machines?

0 Karma

Ultra Champion

hello @rapmancz,
i feel the word "necessary" is pretty strong.
i would say, it is recommended, and will add, that there is so much more to collect then the free space in percentage from clients
having said that, read here about bringing windows data in:
if disk usage is all you need, then only enable the perfmon disk input and set the desired interval.
regarding "complicated", installing a forwarder is very straight forward, read here:
then you can silently install fast via simple script on all your hosts, read here:
then you can actually controll all the inputs of all your forwarders from a single interface using Forwarder Management, start reading here:
to your last question, 99% of the Splunk environments that i have seen leverage the Universal Forwarder and TA for windows (or msad, exchange, whatever) to collect windows data.

p.s. if it takes you more than a work day to bring that data in, ping us here and i am positive the community will give you the boost you need to accomplish your task

good luck and happy splunking

0 Karma


Thank you for your comment.

I installed Universal forwarder 6.6.2 on one test machine (Windows 7 32bit) and activated checkboxes to send event log data and performance data.

In Splunk Enterprise 6.6.2, I can see windows event log entries, but no performance data. When searching for events from this machine, I can see it writes only to main index, no entries in perfmon index.

0 Karma

Ultra Champion
0 Karma
Get Updates on the Splunk Community!

Introducing the Splunk Community Dashboard Challenge!

Welcome to Splunk Community Dashboard Challenge! This is your chance to showcase your skills in creating ...

Get the T-shirt to Prove You Survived Splunk University Bootcamp

As if Splunk University, in Las Vegas, in-person, with three days of bootcamps and labs weren’t enough, now ...

Wondering How to Build Resiliency in the Cloud?

IT leaders are choosing Splunk Cloud as an ideal cloud transformation platform to drive business resilience,  ...