Hi, I have probably and easy question for the ones that have done this before. I have set up an universal forwarder to collect windows performance counters, the collection and forwarding works fine. The thing i am curious about is that In the forwarders inputs config I have specified it to collect:
stats = average;min;max;dev;count
But in Splunk i receive an event containing value, min, max, dev and count. Everything except the "average" value. Is this contained in the value field instead, or have I done something wrong in the config?
collection=Processor object=Processor counter="% Idle Time" instance=_Total Value=97.1635562216005 Min=59.084268219671145 Max=99.46225663681797 Dev=6.00739691330151 Count=300 |
from config:
[perfmon://Processor]
index = main
interval = 600
counters = % Processor Time;% Idle Time
object = Processor
instances = *
formatString = %.20g
instance = _Total;% Idle Time
samplingInterval = 2000
stats = average;min;max;dev;count
mode = single
disabled = false
Hi @hethu,
only one question: did you created your input by yourself or you used the one contained in the Splunk_TA_Windows?
If you created by yourself, I hint to try the above Add-On that contains all the counter that are usually used.
Anyway, an average can be easily calculated in the stats command using the avg option.
Ciao.
Giuseppe
Hi @hethu,
only one question: did you created your input by yourself or you used the one contained in the Splunk_TA_Windows?
If you created by yourself, I hint to try the above Add-On that contains all the counter that are usually used.
Anyway, an average can be easily calculated in the stats command using the avg option.
Ciao.
Giuseppe
Hi @hethu,
good for you, see next time!
Ciao and happy splunking.
Giuseppe
P.S.: Karma Points are appreciated 😉
