Splunk Search

Windows performon- not getting collected

johnsasikumar
Path Finder

Hi ,
I have set up UF to collect data from one server to my indexer. The connection between my Indexer adn UF is fine as we are able to index other data files. Am able to collect and monitor data using my UF but it is not collecting windows metrics.

Am using the below in my inputs .conf to collect windows metrics

[perfmon://CPU]
counters = % C1 Time;% C2 Time;% Idle Time;% Processor Time;% User Time;% Privileged Time;% Reserved Time;% Interrupt Time
instances = *
interval = 30
object = Processor
mode = single
index = em_metrics
_meta = role::dps os::"Microsoft Windows Server 2012 R2 Datacenter" os_version::6.3.9600 ip::"XX.XX.XX.XX" entity_type::Windows_Host

The same inputs.conf is able to pick up data from 2 other servers but not this. Could any one suggest a solution

Tags (1)
0 Karma

sbattista09
Contributor

are you using the windows TA?

in the defaults the Splunk_TA_windows are as follows, you might be able to drop this (with a few edits to index and disabled) hope this helps.

Splunk 5.0+ Performance Counters

CPU

[perfmon://CPU]
counters = % Processor Time; % User Time; % Privileged Time; Interrupts/sec; % DPC Time; % Interrupt Time; DPCs Queued/sec; DPC Rate; % Idle Time; % C1 Time; % C2 Time; % C3 Time; C1 Transitions/sec; C2 Transitions/sec; C3 Transitions/sec
disabled = 1
instances = *
interval = 10
object = Processor
useEnglishOnly=true
index = perfmon

0 Karma
Get Updates on the Splunk Community!

Shape the Future of Splunk: Join the Product Research Lab!

Join the Splunk Product Research Lab and connect with us in the Slack channel #product-research-lab to get ...

Auto-Injector for Everything Else: Making OpenTelemetry Truly Universal

You might have seen Splunk’s recent announcement about donating the OpenTelemetry Injector to the ...

[Puzzles] Solve, Learn, Repeat: Character substitutions with Regular Expressions

This challenge was first posted on Slack #puzzles channelFor BORE at .conf23, we had a puzzle question which ...