IT Operations Discussions
All the up-time. All the nines.

Splunk add-on for TA_windows generate a lot of perfmon data

Tankwell
Explorer

Hey all,
We have recently configured our new App for Microsoft Exchange, and we started to get a lot of perfmon data [about 20G a day from a given server]

We have wondered is a best practices about the polling frequency of perfmon counters like CPU, ThreadCount ?

We would like to turn down some of them in the inputs.conf in our forwarders, but we do not know if the Exchange app dashboards uses these values....

So 2 questions - 

  1.  Is there a bset practices using and polling perfmon data?
  2. Is there a way to know which perfmon counters The exchange app dashboards needs?

Thanks a lot  😊
Tankwell

Tags (1)
0 Karma

tscroggins
Influencer

@Tankwell 

Splunk App for Microsoft Exchange is a paid add-on. Best practices for performance monitoring in general may differ from best practices in this context. For example, the app expects perfmon events in single (more data, more expensive) rather than multikv (optimized data, less expensive) mode. Only Splunk can provide the reasoning behind this. I recommend contacting Splunk sales or support directly.

0 Karma

Tankwell
Explorer

We have also found a lot of winnetmon data....

Each packet was written as an event

Also we have renderxml attribute on windows event log inputs in order to save disk space....

 

Farthermore, we are looking for a way to keep a lot of events in the short term and only few of them in the long term.

For example, if we poll CPU information each 10 seconds, is there a way to save for a long term only 1 event per 5 minutes?

In general - is there a way to keep only few events from the index after a while?

 

 

 

 

0 Karma
Get Updates on the Splunk Community!

Enterprise Security Content Update (ESCU) | New Releases

In January, the Splunk Threat Research Team had one release of new security content via the Splunk ES Content ...

Expert Tips from Splunk Professional Services, Ensuring Compliance, and More New ...

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...

Observability Release Update: AI Assistant, AppD + Observability Cloud Integrations & ...

This month’s releases across the Splunk Observability portfolio deliver earlier detection and faster ...