Windows Performance counters inputs config question

[hethu]

Hi, I have probably and easy question for the ones that have done this before. I have set up an universal forwarder to collect windows performance counters, the collection and forwarding works fine. The thing i am curious about  is that In the forwarders inputs config I have specified it to collect:

stats = average;min;max;dev;count

But in Splunk i receive an event containing value, min, max, dev and count. Everything except the  "average" value. Is this contained in the value field instead, or have I done something wrong in the config?

collection=Processor

object=Processor

counter="% Idle Time"

instance=_Total

Value=97.1635562216005

Min=59.084268219671145

Max=99.46225663681797

Dev=6.00739691330151

Count=300

from config:
[perfmon://Processor]
index = main
interval = 600
counters = % Processor Time;% Idle Time
object = Processor
instances = *
formatString = %.20g
instance = _Total;% Idle Time
samplingInterval = 2000
stats = average;min;max;dev;count
mode = single
disabled = false

[gcusello · Accepted solution]

Hi @hethu,

only one question: did you created your input by yourself or you used the one contained in the Splunk_TA_Windows?

If you created by yourself, I hint to try the above Add-On that contains all the counter that are usually used.

Anyway, an average can be easily calculated in the stats command using the avg option.

Ciao.

Giuseppe

[gcusello]

Hi @hethu,

good for you, see next time!

Ciao and happy splunking.

Giuseppe

P.S.: Karma Points are appreciated 😉