Getting Data In

How to make sure I am receiving CPU or memory information from my Splunk server?

antonovfr
New Member

Hi everyone,

I just started with Splunk and I am doing some testing on this software.

I have previously used Elasticsearch so I have some basic understanding of the way Splunk works.

I have a Splunk server installed on an Ubuntu VM. My Windows host is sending logs via a universal forwarder.

I would like to display and search performance informations on the Splunk server. So I went in add data, I choose my host, then host performance monitoring (translation from french) then I choose % User Time in processor, give a Test2 name, choose the "*" instance and set the interval to 10 sec. I then choose the default index.

But then I don't know where to read those information. It doesn't appear in the Search and Reporting app.

Thanks in advance for your help.

0 Karma
1 Solution

koshyk
Super Champion

The best way to tackle this is (rather than you writing everything from scratch)
- In your Windows remote machine , collect the performance metrics by adding the Perfmon Stanza as per this link to your UF
- Ensure correct indexes are present in your Splunk Enterprise while collecting them
- Ensure you install Splunk_TA_windows which does all the hard-work for you (normalising, field extraction etc.)
- Then install the Splunk App for Windows Infrastructure which will give you all dashboards and searches

View solution in original post

koshyk
Super Champion

The best way to tackle this is (rather than you writing everything from scratch)
- In your Windows remote machine , collect the performance metrics by adding the Perfmon Stanza as per this link to your UF
- Ensure correct indexes are present in your Splunk Enterprise while collecting them
- Ensure you install Splunk_TA_windows which does all the hard-work for you (normalising, field extraction etc.)
- Then install the Splunk App for Windows Infrastructure which will give you all dashboards and searches

rmanrique
Path Finder
0 Karma

antonovfr
New Member

Thanks a lot. I needed to add the perfmon Stanza in the config file of my universal forwarder

0 Karma
Get Updates on the Splunk Community!

This Week's Community Digest - Splunk Community Happenings [9.26.22]

Get the latest news and updates from the Splunk Community here! Upcoming User Group Events! 👏 Check ...

BSides Splunk 2022 - The Call for Papers is now Open!

TLDR; Main Site: https://bsidessplunk.com CFP Site: https://bsidessplunk.com/cfp CFP Opens: December 15th, ...

Sending Metrics to Splunk Enterprise With the OpenTelemetry Collector

This blog post is part of an ongoing series on OpenTelemetry. The OpenTelemetry project is the second largest ...