sending perfmon data to indexer from UF

[Splunk_U]

I have an universal forwarder in windows machine. I want to send the perfmon data from the UF to the indexer (a linux machine). How to do that?

[jonuwz]

You should have the opportunity to configure perfmon inputs at install time.

If re-installing the UF is not an option take a look at the bottom of this page for how to add entries to <install dir>\etc\system\local\inputs.conf to forward perfmon data.

You'll need to restart the UF service for hte change to take effect.

Note :

1. The interval is in seconds, '1' might be too frequent for you.
2. You might want to create a new index to store the performance data

Edit

For example add this to etc/system/local/inputs.conf (example from the link above) :

[perfmon://LocalMainMemory]
interval = 5
object = Memory
counters = Committed Bytes; Available Bytes; % Committed Bytes In Use
disabled = 0
index = main

and restart your service.

[jonuwz]

not sure where perfmon.conf or wmi.conf come into it.

Just add entries to inputs.conf and restart

[Splunk_U]

I am not able to see perfmon.conf file in the default. shall I create the wmi.conf file?