ok that was what I was looking for. Just confirmation on what I thought to be the case but hoped wasn't lol. Thank you Chris. If you could move your comment out I will mark it as the answer ... View more

I apologize, still fairly new to the Cluster Master(what I accidentally referred to as a master node), Deployer Server, Deployment server trinity. The HF are not clustered but we do have quite a few. We use a deployment server to add new apps to the HF. What I am trying to figure out is how to control this from a central point without having to log on to each HF to update any URL monitors we implement while not creating a massive amount of duplicate data. In the case of a UF vs a HF I have not found any documentation where I can use this from a UF. In the case of the other apps it was easy to know exactly how it operated since they are monitoring a local resource through a UF. Just set up the parameters and deploy to the UF, boom you got data and it is centrally managed. It also helps that they have install steps in the case of a distributed environment such as ours whereas the page for this one does not. I have only been able to find it where you directly install it on the HF and manage it from the Web UI of said forwarder. ... View more

I have not found anything regarding using logs to metrics to utilize the output of the Splunk Add-on for *nix. If you have a link specifically for that and not the generalized article for Logs2Metrics I would more than be happy to look over it and attempt it. ... View more

That would be amazing my friend. If you need help testing let me know. We have a small lab specifically for testing new versions of splunk and add ons. Keep us posted if you would be so kind. Thanks! ... View more

I have it setup precisely how that is set up and it is giving me the following error Search peer 1 has the following message: Index Processor: Metric name is missing for source=Process, sourcetype=Process, host=servername, index=winmetrics. Metric event data without metric name is invalid and would not be indexed. Ensure the input metric data is not malformed. I have it set up exactly how the first link you gave me is set up. Do you have this working? ... View more

so, that did not work. Testing some other transforms in the hopes of stumbling my way into an answer lol ... View more

I have looked at that but without anyone confirming whether it worked or not made me skeptical. I will talk with my props\transforms guy and see if he thinks it would work. Thanks for all the help and I will report back if it works. ... View more

We use the Splunk add-on for Windows and it has the perfmon stanzas in the inputs.conf. Those however do not provide the data in a way that the Metrics index will accept. What I am aiming to do is create the stack in the Metrics Workspace to be able to dig down through related objects when an issue arises. I have been unable to find anything other than "Getting Data in from other Sources" and it talks about HEC and metrics-csv inputs but no links to best practices on creating the CSVs for ingest to the Metrics index. Basically, what the question is based around is what is the best way to create the csv or transform the perfmon data into a csv for ingest into the metrics index. If that is not the best way to go about it than what is the suggested path to get that data in a format that a metrics index will accept? Hopefully that clears up what this question is really about. ... View more