Perfmon: Unable to get data from index search

[prsubramanian]

Hi,
I want to get the CPU Usage of windows host - CPU Usage, so trying to get the CPU Usage using counters = % Processor Time; from below inputs.conf

Inputs.conf:

[perfmon://Host Process]
_TCP_ROUTING = Infra_monitoring_indexer1
counters = % Processor Time; Thread Count; ID Process; Private Bytes; IO Read Operations/sec; IO Write Operations/sec; Virtual Bytes; Page File Bytes
disabled = 0
instances = *
interval = 60
object = Process
index = Process_tier1_idx
showZeroValue = 1

Path: C:\Program Files\Splunk\etc\apps\process-windows-idx\appserver\addons\win_x86_64\Splunk_TA_windows\default\inputs.conf

After restarting the Splunk service and search using index=Process_tier1_idx but no results were displaying.

Please let me know how to get data in the index?
Thanks.

[jacobpevans · Accepted solution]

Greetings @prsubramanian,

For starters, never, ever, ever modify any file in the \default\ directory, EVER. If you ever go to upgrade your Splunk TA Windows app (which hopefully you will), all changes in \default\ will be overridden. This is expected, default Splunk behavior for all apps. Before you continue on, restore the \default\ folder back to what it was when you installed the app.

Once you've finished that, your issue is that the CPU counters listed are not in the [perfmon://Host Process] stanza. Instead of modifying the \default\ directory, copy \defaults\inputs.conf into \local\inputs.conf. Now, you can edit this file (in the \local\ directory).

Delete everything in this file except for this stanza: [perfmon://CPU].

This should be your entire \local\inputs.conf:

[perfmon://CPU]
disabled = 0
index = Process_tier1_idx

This will enable all CPU counters for you. A restart after making these changes will bring data to your index. If you'd only like some of the counters, feel free to further restrict them, e.g.:

[perfmon://CPU]
counters = % Processor Time
disabled = 0
index = Process_tier1_idx

followed by another restart.

Cheers,
Jacob

[jacobpevans]

I also just noticed that your installation path does not look correct. I recommend deleting the Splunk_TA_Windows folder and reinstalling via the Splunk GUI. The path for any Splunk app or add-on should look like this:

$SPLUNK_HOME\etc\apps\Splunk_TA_windows

Where $SPLUNK_HOME is C:\Program Files\Splunk for your installation.