Why is our Windows universal forwarder forwarding perfmon data to main, not the perfmon index?

[ateixeira_splun]

Hi,

I was checking a fresh Universal Forwarder installation I did on a Windows VM and found the following at inputs.conf, under TA subdirs:

[perfmon://Network Interface]
counters = Bytes Received/sec;Bytes Sent/sec
instances = *
interval = 10
object = Network Interface

[perfmon://CPUTime]
counters = % Processor Time;% User Time
disabled = 0
index = perfmon
instances = _Total
interval = 10
object = Processor
useEnglishOnly = true

The perfmon along with win events were set by me to be forwarded during the UF installation (which comes bundled with Win-TA). As you can see, CPUTime entry/stanza, like many others, is properly set to send data to perfmon index. The configuration was created by the GUI installer, after checking a few boxes for performance data collections/inputs.

However, why is Network Interface data (along with and Available Memory, CPU Load) NOT configured - by default - to be stored in the perfmon index? Is this common or maybe an issue? I’ve verified and everything is being indexed in main index instead. The perfmon index is present on the indexer though.

I am using the latest versions for UF/Indexer, downloaded last week (July-2015):

VERSION=6.2.3
BUILD=264376
PRODUCT=splunk
PLATFORM=Windows-AMD64

Any help highly appreciated.

Regards,
Alex

[benafo]

You can edit the input.conf on the [perfmon://Network Interface] to forward events to the perfmon indexer:

[perfmon://Network Interface]
counters = Bytes Received/sec;Bytes Sent/sec
index = perfmon
instances = *
interval = 10
object = Network Interface

[srisahitya_v]

hi buddies,

1. download and install the https://splunkbase.splunk.com/app/272/ app in splunk.
2. after go to Splunk_home/etc/apps/windows/local--> inputs.conf
3. add wanted index name for every stanza. (or) copy paste same stanzas in Universal forwarder inputs.conf file.(add "index=perfmon" stanza).
4. check weather index=perfmon is created or not. if not create once.
5. restart the index and forwarder to make changes enable.

[kiranrm]

I am also seeing a similar issue.. Any answers!!