Hi,
I was checking a fresh Universal Forwarder installation I did on a Windows VM and found the following at inputs.conf, under TA subdirs:
[perfmon://Network Interface]
counters = Bytes Received/sec;Bytes Sent/sec
instances = *
interval = 10
object = Network Interface
[perfmon://CPUTime]
counters = % Processor Time;% User Time
disabled = 0
index = perfmon
instances = _Total
interval = 10
object = Processor
useEnglishOnly = true
The perfmon along with win events were set by me to be forwarded during the UF installation (which comes bundled with Win-TA). As you can see, CPUTime entry/stanza, like many others, is properly set to send data to perfmon index. The configuration was created by the GUI installer, after checking a few boxes for performance data collections/inputs.
However, why is Network Interface data (along with and Available Memory, CPU Load) NOT configured - by default - to be stored in the perfmon index? Is this common or maybe an issue? I’ve verified and everything is being indexed in main index instead. The perfmon index is present on the indexer though.
I am using the latest versions for UF/Indexer, downloaded last week (July-2015):
VERSION=6.2.3
BUILD=264376
PRODUCT=splunk
PLATFORM=Windows-AMD64
Any help highly appreciated.
Regards,
Alex
... View more