perfmon is not working

[john]

hi,

I want to know how perfmon.cof is working.Since i want to use that for monitoring CPU utilization.I want to know is that feasible to use perfmon for this.

This is my perfmon.conf and i have run this query in search index="os"
but it didnt return any result.So please tell me wether any other configration i need to do to make this work.Since i could not find anything in doc.

perfmon.cof

[PERFMON:LocalPhysicalDisk]
interval = 0
object = PhysicalDisk
counters = Disk Bytes/sec; % Disk Read Time; % Disk Write Time; % Disk Time
instances = *
disabled = 0
index = PerfMon

[PERFMON:LocalMainMemory]
interval = 5
object = Memory
counters = Committed Bytes; Available Bytes; % Committed Bytes In Use
disabled = 0
index = os

[PERFMON:USBChanges]
interval = 10
object = USB
counters = Usb Control Data Bytes/Sec
instances = *
disabled = 0

Thanks,

[yannK]

First of all, the filename should be perfmon.conf not perfmon.cof

to troubleshoot:

• Please try to specify the case sensitive indexes

  index = PerfMon OR index=os OR index=main

  • and if you don't see anything, search for perfmon errors in splunk logs

    index=_internal source=*splunkd.log perfmon
    

  • finally, double check that splunk service is running under an user with system permission to call the performance monitor.

[john]

even these indexes are also not created PerfMon and Os.

[john]

Hi yank thank for your answer.The second query is running fine in my search.But the first query that u mentioned is not working what could be the issues since i need the cpu usage details instead of splunk performance details please guide me on this