- Find Answers
- :
- Splunk Administration
- :
- Getting Data In
- :
- Windows perfmon stats
- Subscribe to RSS Feed
- Mark Topic as New
- Mark Topic as Read
- Float this Topic for Current User
- Bookmark Topic
- Subscribe to Topic
- Mute Topic
- Printer Friendly Page
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Does anyone have a sample stanza for inputs.conf for capturing Windows perfmon stats such as CPU utilization, memory utilization and disk utilization? I was hoping the stanza would include the actual counters and such. Just looking for the basics. I could not find any good baseline samples.
Thank you very much!
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Please refer Splunk Add-On for Microsoft Windows. It has many inputs. You can deploy this add-on as is OR you can tweak the input parameters per the use case.
https://splunkbase.splunk.com/app/742/
Sample perfmon stanza for CPU
[perfmon://CPU] counters = % Processor Time; % User Time; % Privileged Time; Interrupts/sec; % DPC Time; % Interrupt Time; DPCs Queued/sec; DPC Rate; % Idle Time; % C1 Time; % C2 Time; % C3 Time; C1 Transitions/sec; C2 Transitions/sec; C3 Transitions/sec disabled = 0 instances = * interval = 10 mode = multikv object = Processor useEnglishOnly=true
index = index_name
-- Hope this helps
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Please refer Splunk Add-On for Microsoft Windows. It has many inputs. You can deploy this add-on as is OR you can tweak the input parameters per the use case.
https://splunkbase.splunk.com/app/742/
Sample perfmon stanza for CPU
[perfmon://CPU] counters = % Processor Time; % User Time; % Privileged Time; Interrupts/sec; % DPC Time; % Interrupt Time; DPCs Queued/sec; DPC Rate; % Idle Time; % C1 Time; % C2 Time; % C3 Time; C1 Transitions/sec; C2 Transitions/sec; C3 Transitions/sec disabled = 0 instances = * interval = 10 mode = multikv object = Processor useEnglishOnly=true
index = index_name
-- Hope this helps
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
thank you
Infographic provides the TL;DR for the 2024 Splunk Career Impact Report
Enterprise Security Content Update (ESCU) | New Releases
Why am I not seeing the finding in Splunk Enterprise Security Analyst Queue?
