splunk-perfmon.path (sic?)

[echalex]

Hi,

As I'm installing TA's on windows hosts, I see that the PerformanceMonitor source is specified as

[script://$SPLUNK_HOME\bin\scripts\splunk-perfmon.path]

The file itself is called splunk-perfmon.exe. Is this intentional - as in disabling accidental usage of the exe, a Splunk trick or a typo?

[bmacias84 · Accepted solution]

I dont think its a trick or a typo. Its very similar to having a bat or sh file referance another path and excutable. If you notice that scripted input referances [script://$SPLUNK_HOME\bin\scripts\splunk-perfmon.path] and splunk-perfmon.path referances $SPLUNK_HOME\bin\splunk-perfmon.exe. I've seen this done in a few TAs.

You could enter the splunk-perfmon.exe path directly, but you have have a script change the return data or formatting with your script. I think scripted inputs are done this way for consistancy when referancing executables.

[echalex]

Yes, it is indeed not a typo or trick. I was staring myself blind at the splunk-perfmon.exe in $SPLUNK_HOME/bin and did not see that the conf actually points to the subdirectory scripts, which includes the .path-scripts.