I installed Splunk (full instance and/or universal forwarder) on OS's in French.
Some stuff will obviously work (such as pulling information from the Windows event logs), but for other stuff, it's less "obvious".
For example, I'm thinking of performance counters. In the French version of the OS, the counter names are different, and contain accents, which Splunk does not recognize. When starting the UF with a localized perfmon.conf file with french counter names, it will error out and report it cannot find the counters (because, in the names it looks for, it will drop accented letters and thus, the counter name does indeed not match).
I've gone through some research, but have not really found anything on this type of thing, beside character set settings in props.conf.
Any pointer or experience on this matter ?
Also, what's the idea as far as distributing conf files for OS'es which are in different languages ? Have different ServerClass'es based on language in order to distribute the appropriate conf file ?
Did you save the file with a Unicode encoding ?
Otherwise you can try to put these in your perfmon.conf.
[PERFMON:CPU Load] counters = 6;142 disabled = 0 instances = _Total interval = 10 object = 238 [PERFMON:Available Memory] counters = 26 disabled = 0 interval = 10 object = 4 [PERFMON:Free Disk Space] counters = 410;408 disabled = 0 instances = _Total interval = 10 object = 236 [PERFMON:Network Interface] counters = 264;506 disabled = 0 instances = * interval = 10 object = 510