Splunk Search

Windows performon- not getting collected

johnsasikumar
Path Finder

Hi ,
I have set up UF to collect data from one server to my indexer. The connection between my Indexer adn UF is fine as we are able to index other data files. Am able to collect and monitor data using my UF but it is not collecting windows metrics.

Am using the below in my inputs .conf to collect windows metrics

[perfmon://CPU]
counters = % C1 Time;% C2 Time;% Idle Time;% Processor Time;% User Time;% Privileged Time;% Reserved Time;% Interrupt Time
instances = *
interval = 30
object = Processor
mode = single
index = em_metrics
_meta = role::dps os::"Microsoft Windows Server 2012 R2 Datacenter" os_version::6.3.9600 ip::"XX.XX.XX.XX" entity_type::Windows_Host

The same inputs.conf is able to pick up data from 2 other servers but not this. Could any one suggest a solution

Tags (1)
0 Karma

sbattista09
Contributor

are you using the windows TA?

in the defaults the Splunk_TA_windows are as follows, you might be able to drop this (with a few edits to index and disabled) hope this helps.

Splunk 5.0+ Performance Counters

CPU

[perfmon://CPU]
counters = % Processor Time; % User Time; % Privileged Time; Interrupts/sec; % DPC Time; % Interrupt Time; DPCs Queued/sec; DPC Rate; % Idle Time; % C1 Time; % C2 Time; % C3 Time; C1 Transitions/sec; C2 Transitions/sec; C3 Transitions/sec
disabled = 1
instances = *
interval = 10
object = Processor
useEnglishOnly=true
index = perfmon

0 Karma
Get Updates on the Splunk Community!

See just what you’ve been missing | Observability tracks at Splunk University

Looking to sharpen your observability skills so you can better understand how to collect and analyze data from ...

Weezer at .conf25? Say it ain’t so!

Hello Splunkers, The countdown to .conf25 is on-and we've just turned up the volume! We're thrilled to ...

How SC4S Makes Suricata Logs Ingestion Simple

Network security monitoring has become increasingly critical for organizations of all sizes. Splunk has ...