Hey dengjin,
I think I understand what you are saying here. The command "./splunk add monitor col1" would be monitoring standard output that perfmon would be printing out to...You are probably best to be running your perfmon command that outputs to a text file and then running your monitor command to monitor that text file.
eg;
./splunk add monitor /var/log/perfmon.log
Please let me know if I have missed what you are asking.
Regards Vince
