I am not sure where to find performance data or which on default index it is stored in

[BRFZ]

Hello,

I installed the forwarder on a Windows machine, and during the installation, I selected the Windows performance monitor to collect performance data. However, I am not sure where to find this data in Splunk or which on default index it is stored in.

[gcusello]

Hi @BRFZ ,

don't use the inputs to select during installation that are enabled in $SPLUNK_HOME\system\local and aren't manageable by Deployment Server.

It's better to don't enable these inputs and install (manually or by Deployment Server) the Splunk_TA_windows, remembering to enable inputs.

In this way, you can also define the index in which these logs are store.

Anyway, answering to your question, by default they are in the main index.

Ciao.

Giuseppe