Initial case (working) :
In an UF add to an inputs.conf (depending of if your using an app, creating local conf or default one, etc.)
[perfmon://< any performance monitoring input>]
counters = *
< others parameters tested and correctly set>
=> All counters are forwarded.
Objective : I want to select a list of counters to limit my Splunk license usage, and to forward & index only the required ones.
Failed cases :
Counters selection fails when counters name contains "-" , worse : no counters are forwarded and/or indexed
=> No counters is forwarded.
counters = * #Host Queue - Instance State Msg Refs - Length;Host Queue - Length;Host Queue - Number of Instances;Host Queue - Suspended Msgs - Length
OR
counters = Host Queue - Instance State Msg Refs - Length;Host Queue - Length;Host Queue - Number of Instances;Host Queue - Suspended Msgs - Length
OR
counters = Host Queue \- Instance State Msg Refs \- Length;Host Queue \- Length;Host Queue \- Number of Instances;Host Queue \- Suspended Msgs \- Length
OR
counters = "Host Queue \- Instance State Msg Refs \- Length";"Host Queue \- Length";"Host Queue \- Number of Instances";"Host Queue \- Suspended Msgs \- Length"
OR
counters = "Host Queue - Instance State Msg Refs - Length";"Host Queue - Length";"Host Queue - Number of Instances";"Host Queue - Suspended Msgs - Length"
OR
counters = \"Host Queue \- Instance State Msg Refs \- Length\";\"Host Queue \- Length\";\"Host Queue \- Number of Instances\";\"Host Queue \- Suspended Msgs \- Length\"
EDIT : Add examples
If the names of the listened app counters I want were
"Host Queue Instance State Msg Refs Length;Host Queue Length;Host Queue Number of Instances;Host Queue Suspended Msgs Length"
instead of
"Host Queue - Instance State Msg Refs - Length;Host Queue - Length;Host Queue - Number of Instances;Host Queue - Suspended Msgs - Length"
The listed counters will be forwarded without any issue.
... View more