PerfMon Data from Windows Forwarders

[tbrown]

I have my Splunk enterprise instance set up on a windows server. I also have 4 universal forwarders set up on Windows servers and 4 more universal forwarders set up on Linux servers. Right now, I want to forward PerfMon stats from the 4 Windows servers. When I was setting up the forwarders on these servers, I checked the boxes in the forwarder installers that allowed certain PerfMon counters to be sent to the Splunk server. Those are successfully sending certain counters like "Available Bytes", "Bytes Received/sec", etc.

My question is how can I add more of these PerfMon counters to be forwarded to my Splunk Server? I saw some information about the Splunk App for Windows, but that was using Deployment clients and things like that, and I was wondering if their was a simpler way of just adding specific PerfMon counters in the forwarder settings on each server. 

Would it be better to use the Splunk App for Windows instead?

[richgalloway]

Since you have multiple forwarders, you should be using a deployment server.  Plan on doing that soon.  It will make it easier to manage the forwarders, especially if more are added in the future.

The simple solution is to edit the inputs.conf files on the Windows servers.  They're probably in $SPLUNK_HOME\etc\system\local, but splunk btool --debug inputs list will tell you for sure.

When you edit the file, you'll see most of the perfmon stanzas have "disabled = 1" in them.  Change the "1" to "0" for those measurements you want to index.  Then restart the UF.