Monitoring Splunk

I am not sure where to find performance data or which on default index it is stored in

BRFZ
Path Finder

Hello,

I installed the forwarder on a Windows machine, and during the installation, I selected the Windows performance monitor to collect performance data. However, I am not sure where to find this data in Splunk or which on default index it is stored in.

0 Karma

gcusello
SplunkTrust
SplunkTrust

Hi @BRFZ ,

don't use the inputs to select during installation that are enabled in $SPLUNK_HOME\system\local and aren't manageable by Deployment Server.

It's better to don't enable these inputs and install (manually or by Deployment Server) the Splunk_TA_windows, remembering to enable inputs.

In this way, you can also define the index in which these logs are store.

Anyway, answering to your question, by default they are in the main index.

Ciao.

Giuseppe

0 Karma
Get Updates on the Splunk Community!

New Case Study Shows the Value of Partnering with Splunk Academic Alliance

The University of Nevada, Las Vegas (UNLV) is another premier research institution helping to shape the next ...

How to Monitor Google Kubernetes Engine (GKE)

We’ve looked at how to integrate Kubernetes environments with Splunk Observability Cloud, but what about ...

Index This | How can you make 45 using only 4?

October 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with this ...