Splunk Search

Windows performon- not getting collected

johnsasikumar
Path Finder

Hi ,
I have set up UF to collect data from one server to my indexer. The connection between my Indexer adn UF is fine as we are able to index other data files. Am able to collect and monitor data using my UF but it is not collecting windows metrics.

Am using the below in my inputs .conf to collect windows metrics

[perfmon://CPU]
counters = % C1 Time;% C2 Time;% Idle Time;% Processor Time;% User Time;% Privileged Time;% Reserved Time;% Interrupt Time
instances = *
interval = 30
object = Processor
mode = single
index = em_metrics
_meta = role::dps os::"Microsoft Windows Server 2012 R2 Datacenter" os_version::6.3.9600 ip::"XX.XX.XX.XX" entity_type::Windows_Host

The same inputs.conf is able to pick up data from 2 other servers but not this. Could any one suggest a solution

Tags (1)
0 Karma

sbattista09
Contributor

are you using the windows TA?

in the defaults the Splunk_TA_windows are as follows, you might be able to drop this (with a few edits to index and disabled) hope this helps.

Splunk 5.0+ Performance Counters

CPU

[perfmon://CPU]
counters = % Processor Time; % User Time; % Privileged Time; Interrupts/sec; % DPC Time; % Interrupt Time; DPCs Queued/sec; DPC Rate; % Idle Time; % C1 Time; % C2 Time; % C3 Time; C1 Transitions/sec; C2 Transitions/sec; C3 Transitions/sec
disabled = 1
instances = *
interval = 10
object = Processor
useEnglishOnly=true
index = perfmon

0 Karma
Get Updates on the Splunk Community!

Splunk Mobile: Your Brand-New Home Screen

Meet Your New Mobile Hub  Hello Splunk Community!  Staying connected to your data—no matter where you are—is ...

Introducing Value Insights (Beta): Understand the Business Impact your organization ...

Real progress on your strategic priorities starts with knowing the business outcomes your teams are delivering ...

Enterprise Security (ES) Essentials 8.3 is Now GA — Smarter Detections, Faster ...

As of today, Enterprise Security (ES) Essentials 8.3 is now generally available, helping SOC teams simplify ...