Getting Data In

Why is our Windows universal forwarder forwarding perfmon data to main, not the perfmon index?

ateixeira_splun
Splunk Employee
Splunk Employee

Hi,

I was checking a fresh Universal Forwarder installation I did on a Windows VM and found the following at inputs.conf, under TA subdirs:

[perfmon://Network Interface]
counters = Bytes Received/sec;Bytes Sent/sec
instances = *
interval = 10
object = Network Interface

[perfmon://CPUTime]
counters = % Processor Time;% User Time
disabled = 0
index = perfmon
instances = _Total
interval = 10
object = Processor
useEnglishOnly = true

The perfmon along with win events were set by me to be forwarded during the UF installation (which comes bundled with Win-TA). As you can see, CPUTime entry/stanza, like many others, is properly set to send data to perfmon index. The configuration was created by the GUI installer, after checking a few boxes for performance data collections/inputs.

However, why is Network Interface data (along with and Available Memory, CPU Load) NOT configured - by default - to be stored in the perfmon index? Is this common or maybe an issue? I’ve verified and everything is being indexed in main index instead. The perfmon index is present on the indexer though.

I am using the latest versions for UF/Indexer, downloaded last week (July-2015):

VERSION=6.2.3
BUILD=264376
PRODUCT=splunk
PLATFORM=Windows-AMD64

Any help highly appreciated.

Regards,
Alex

benafo
Explorer

You can edit the input.conf on the [perfmon://Network Interface] to forward events to the perfmon indexer:

[perfmon://Network Interface]
counters = Bytes Received/sec;Bytes Sent/sec
index = perfmon
instances = *
interval = 10
object = Network Interface

0 Karma

srisahitya_v
Communicator

hi buddies,

  1. download and install the https://splunkbase.splunk.com/app/272/ app in splunk.
  2. after go to Splunk_home/etc/apps/windows/local--> inputs.conf
  3. add wanted index name for every stanza. (or) copy paste same stanzas in Universal forwarder inputs.conf file.(add "index=perfmon" stanza).
  4. check weather index=perfmon is created or not. if not create once.
  5. restart the index and forwarder to make changes enable.
0 Karma

kiranrm
New Member

I am also seeing a similar issue.. Any answers!!

0 Karma
Get Updates on the Splunk Community!

Splunk Decoded: Service Maps vs Service Analyzer Tree View vs Flow Maps

It’s Monday morning, and your phone is buzzing with alert escalations – your customer-facing portal is running ...

What’s New in Splunk Observability – September 2025

What's NewWe are excited to announce the latest enhancements to Splunk Observability, designed to help ITOps ...

Fun with Regular Expression - multiples of nine

Fun with Regular Expression - multiples of nineThis challenge was first posted on Slack #regex channel ...