Splunk Search

Windows performon- not getting collected

johnsasikumar
Path Finder

Hi ,
I have set up UF to collect data from one server to my indexer. The connection between my Indexer adn UF is fine as we are able to index other data files. Am able to collect and monitor data using my UF but it is not collecting windows metrics.

Am using the below in my inputs .conf to collect windows metrics

[perfmon://CPU]
counters = % C1 Time;% C2 Time;% Idle Time;% Processor Time;% User Time;% Privileged Time;% Reserved Time;% Interrupt Time
instances = *
interval = 30
object = Processor
mode = single
index = em_metrics
_meta = role::dps os::"Microsoft Windows Server 2012 R2 Datacenter" os_version::6.3.9600 ip::"XX.XX.XX.XX" entity_type::Windows_Host

The same inputs.conf is able to pick up data from 2 other servers but not this. Could any one suggest a solution

Tags (1)
0 Karma

sbattista09
Contributor

are you using the windows TA?

in the defaults the Splunk_TA_windows are as follows, you might be able to drop this (with a few edits to index and disabled) hope this helps.

Splunk 5.0+ Performance Counters

CPU

[perfmon://CPU]
counters = % Processor Time; % User Time; % Privileged Time; Interrupts/sec; % DPC Time; % Interrupt Time; DPCs Queued/sec; DPC Rate; % Idle Time; % C1 Time; % C2 Time; % C3 Time; C1 Transitions/sec; C2 Transitions/sec; C3 Transitions/sec
disabled = 1
instances = *
interval = 10
object = Processor
useEnglishOnly=true
index = perfmon

0 Karma
Get Updates on the Splunk Community!

Announcing Scheduled Export GA for Dashboard Studio

We're excited to announce the general availability of Scheduled Export for Dashboard Studio. Starting in ...

Extending Observability Content to Splunk Cloud

Watch Now!   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to leverage ...

More Control Over Your Monitoring Costs with Archived Metrics GA in US-AWS!

What if there was a way you could keep all the metrics data you need while saving on storage costs?This is now ...