IT Operations Discussions
All the up-time. All the nines.

Splunk add-on for TA_windows generate a lot of perfmon data


Hey all,
We have recently configured our new App for Microsoft Exchange, and we started to get a lot of perfmon data [about 20G a day from a given server]

We have wondered is a best practices about the polling frequency of perfmon counters like CPU, ThreadCount ?

We would like to turn down some of them in the inputs.conf in our forwarders, but we do not know if the Exchange app dashboards uses these values....

So 2 questions - 

  1.  Is there a bset practices using and polling perfmon data?
  2. Is there a way to know which perfmon counters The exchange app dashboards needs?

Thanks a lot  😊

Tags (1)
0 Karma



Splunk App for Microsoft Exchange is a paid add-on. Best practices for performance monitoring in general may differ from best practices in this context. For example, the app expects perfmon events in single (more data, more expensive) rather than multikv (optimized data, less expensive) mode. Only Splunk can provide the reasoning behind this. I recommend contacting Splunk sales or support directly.

0 Karma


We have also found a lot of winnetmon data....

Each packet was written as an event

Also we have renderxml attribute on windows event log inputs in order to save disk space....


Farthermore, we are looking for a way to keep a lot of events in the short term and only few of them in the long term.

For example, if we poll CPU information each 10 seconds, is there a way to save for a long term only 1 event per 5 minutes?

In general - is there a way to keep only few events from the index after a while?





0 Karma
Get Updates on the Splunk Community!

Security Highlights: September 2022 Newsletter

 September 2022 The Splunk App for Fraud Analytics (SFA) is now Splunk SupportedUse your existing Splunk ...

Platform Highlights | September 2022 Newsletter

 September 2022 What’s New in 9.0 and How to UpgradeGet a walk through of what is new Splunk Enterprise 9.0 ...

Observability Highlights | September 2022 Newsletter

 September 2022 Splunk Observability SuiteAccess to "Classic" SignalFx Interface Will be Removed on Sept 30, ...