How to merge performance counters from several servers in Splunk to get a global view of the sum of each counter from each server?

[vtortola]

I have a service that runs in 4 different servers. Each instance has its own performance counters and usually we jump from server to server to see how the service doing.

Is it possible with Splunk to get a global view of those performance counters that show the sum of each counter from each server?

Some of those counters show how many requests are being processed per second, so I would like to see how many requests per second are being processed by the 4 servers as a whole.

Thanks.

[alacercogitatus]

Are you referring to windows services?

[woodcock]

Yes, this is exactly what Splunk is designed to do and it is very good at it. You would probably do is add a scripted input to pull the KPIs from each server and then you can go crazy alerting, charting and dashboarding that data.

[vtortola]

Do you know where can I find any documentation about how to do it?

[woodcock]

Start here; it is very easy:

http://docs.splunk.com/Documentation/Splunk/6.2.3/AdvancedDev/ScriptedInputsIntro

[woodcock]

If it is WMI/Perfmon, this is a good reference:

http://www.middlewaretweaks.com/monitor/splunk-wmi-monitoring-windows-without-agent-using-wmi/