Getting Data In

Why is Windows universal forwarder always sending performance stats to the main index every 10 seconds?

randric
Engager

I am trying to forward the performance stats (CPU, Memory) from Windows Universal forwarder to Splunk Indexer on remote server (Linux 6.2.3). I am modifying the inputs.conf file in /etc/system/local,but whatever I do, as soon as I start the Windows Forwarder Server, Splunk Indexer gets performance stats every 10 seconds in the main index (instead of perfmon index I have created for this purpose).

inputs.conf looks like:

[script://$SPLUNK_HOME\bin\scripts\splunk-wmi.path]
disabled = 0

# Perfmon: Windows performance monitoring examples
[perfmon://LocalMainMemory]
interval = 60
object = Memory
counters = Committed Bytes; Available Bytes; % Committed Bytes In Use
disabled = 0
index = perfmon

[perfmon://LocalPhysicalDisk]
interval = 60
object = PhysicalDisk
counters = Disk Bytes/sec; % Disk Read Time; % Disk Write Time; % Disk Time
instances = *
disabled = 0
index = perfmon

[perfmon://Processor]
object = Processor
instances = _Total
counters = % Processor Time;% User Time
useEnglishOnly = 1
interval = 60
disabled = 0

Did anybody experience this issue? Any suggestions?

1 Solution

nk-1
Path Finder

I define the PerfMon stanzas in

C:\Program Files\SplunkUniversalForwarder\etc\apps\Splunk_TA_windows\local\inputs.conf

not

C:\Program Files\SplunkUniversalForwarder\etc\system\local\inputs.conf

View solution in original post

bmacias84
Champion

You should install you config under the $SPLUNK_HOME/etc/apps . If you want to find out why your configs are not work correctly. Run the following

$SPLUNK_HOME/etc/bin/splunk cmd btool --debug inputs list

This command will out put debug statement will out the final inputs.conf file as applied with your server/machine. It will include which file is override each stanza and settings.

0 Karma

nk-1
Path Finder

I define the PerfMon stanzas in

C:\Program Files\SplunkUniversalForwarder\etc\apps\Splunk_TA_windows\local\inputs.conf

not

C:\Program Files\SplunkUniversalForwarder\etc\system\local\inputs.conf

randric
Engager

Thank you sir - this fixed it. Did I miss this in documentation somewhere?

0 Karma
Career Survey
First 500 qualified respondents will receive a $20 gift card! Tell us about your professional Splunk journey.
Get Updates on the Splunk Community!

Introduction to Splunk AI

How are you using AI in Splunk? Whether you see AI as a threat or opportunity, AI is here to stay. Lucky for ...

Splunk + ThousandEyes: Correlate frontend, app, and network data to troubleshoot ...

Are you tired of troubleshooting delays caused by siloed frontend, application, and network data? We've got a ...

Maximizing the Value of Splunk ES 8.x

Splunk Enterprise Security (ES) continues to be a leader in the Gartner Magic Quadrant, reflecting its pivotal ...