Splunk Search

Windows performon- not getting collected

johnsasikumar
Path Finder

Hi ,
I have set up UF to collect data from one server to my indexer. The connection between my Indexer adn UF is fine as we are able to index other data files. Am able to collect and monitor data using my UF but it is not collecting windows metrics.

Am using the below in my inputs .conf to collect windows metrics

[perfmon://CPU]
counters = % C1 Time;% C2 Time;% Idle Time;% Processor Time;% User Time;% Privileged Time;% Reserved Time;% Interrupt Time
instances = *
interval = 30
object = Processor
mode = single
index = em_metrics
_meta = role::dps os::"Microsoft Windows Server 2012 R2 Datacenter" os_version::6.3.9600 ip::"XX.XX.XX.XX" entity_type::Windows_Host

The same inputs.conf is able to pick up data from 2 other servers but not this. Could any one suggest a solution

Tags (1)
0 Karma

sbattista09
Contributor

are you using the windows TA?

in the defaults the Splunk_TA_windows are as follows, you might be able to drop this (with a few edits to index and disabled) hope this helps.

Splunk 5.0+ Performance Counters

CPU

[perfmon://CPU]
counters = % Processor Time; % User Time; % Privileged Time; Interrupts/sec; % DPC Time; % Interrupt Time; DPCs Queued/sec; DPC Rate; % Idle Time; % C1 Time; % C2 Time; % C3 Time; C1 Transitions/sec; C2 Transitions/sec; C3 Transitions/sec
disabled = 1
instances = *
interval = 10
object = Processor
useEnglishOnly=true
index = perfmon

0 Karma
Get Updates on the Splunk Community!

Stay Connected: Your Guide to May Tech Talks, Office Hours, and Webinars!

Take a look below to explore our upcoming Community Office Hours, Tech Talks, and Webinars this month. This ...

They're back! Join the SplunkTrust and MVP at .conf24

With our highly anticipated annual conference, .conf, comes the fez-wearers you can trust! The SplunkTrust, as ...

Enterprise Security Content Update (ESCU) | New Releases

Last month, the Splunk Threat Research Team had two releases of new security content via the Enterprise ...