Getting Data In

What configuration file do I need to edit on a Windows universal forwarder to exclude performance monitoring?

bharrell
Path Finder

Brand new to Splunk. Installed the universal forwarder on a Windows Server and see the logs populating on my Splunk Light server. I want to re-configure the forwarder to not include performance monitoring (which I selected on install.)

Where is the conf file that I need to edit? I see documentation that points to conf files located here:
C:\Program Files\SplunkUniversalForwarder\etc\system\local

But I don't see any data relating to which logs and performance monitoring is being forwarded here.

0 Karma
1 Solution

dkoshe_splunk
Splunk Employee
Splunk Employee

Look for file C:\Program Files\SplkUniversalForwarder\etc\apps\Splunk_TA_windows\local\inputs.conf
For entries starting with [perfmon:// add/change property disabled=1

View solution in original post

dkoshe_splunk
Splunk Employee
Splunk Employee

Look for file C:\Program Files\SplkUniversalForwarder\etc\apps\Splunk_TA_windows\local\inputs.conf
For entries starting with [perfmon:// add/change property disabled=1

bharrell
Path Finder

Thanks. This looks like exactly what I need. Before I posted this I did numerous searches for this info and couldn't find it. There was plenty of very confusing info about conf file precedence though! Any links that explain the configuration of the forwarder in simple examples would also be appreciated.

0 Karma
Get Updates on the Splunk Community!

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...

Let’s Get You Certified – Vegas-Style at .conf24

Are you ready to level up your Splunk game? Then, let’s get you certified live at .conf24 – our annual user ...