Getting Data In

How to make sure I am receiving CPU or memory information from my Splunk server?

antonovfr
New Member

Hi everyone,

I just started with Splunk and I am doing some testing on this software.

I have previously used Elasticsearch so I have some basic understanding of the way Splunk works.

I have a Splunk server installed on an Ubuntu VM. My Windows host is sending logs via a universal forwarder.

I would like to display and search performance informations on the Splunk server. So I went in add data, I choose my host, then host performance monitoring (translation from french) then I choose % User Time in processor, give a Test2 name, choose the "*" instance and set the interval to 10 sec. I then choose the default index.

But then I don't know where to read those information. It doesn't appear in the Search and Reporting app.

Thanks in advance for your help.

0 Karma
1 Solution

koshyk
Super Champion

The best way to tackle this is (rather than you writing everything from scratch)
- In your Windows remote machine , collect the performance metrics by adding the Perfmon Stanza as per this link to your UF
- Ensure correct indexes are present in your Splunk Enterprise while collecting them
- Ensure you install Splunk_TA_windows which does all the hard-work for you (normalising, field extraction etc.)
- Then install the Splunk App for Windows Infrastructure which will give you all dashboards and searches

View solution in original post

koshyk
Super Champion

The best way to tackle this is (rather than you writing everything from scratch)
- In your Windows remote machine , collect the performance metrics by adding the Perfmon Stanza as per this link to your UF
- Ensure correct indexes are present in your Splunk Enterprise while collecting them
- Ensure you install Splunk_TA_windows which does all the hard-work for you (normalising, field extraction etc.)
- Then install the Splunk App for Windows Infrastructure which will give you all dashboards and searches

rmanrique
Path Finder
0 Karma

antonovfr
New Member

Thanks a lot. I needed to add the perfmon Stanza in the config file of my universal forwarder

0 Karma
Get Updates on the Splunk Community!

Security Highlights: September 2022 Newsletter

 September 2022 The Splunk App for Fraud Analytics (SFA) is now Splunk SupportedUse your existing Splunk ...

Platform Highlights | September 2022 Newsletter

 September 2022 What’s New in 9.0 and How to UpgradeGet a walk through of what is new Splunk Enterprise 9.0 ...

Observability Highlights | September 2022 Newsletter

 September 2022 Splunk Observability SuiteAccess to "Classic" SignalFx Interface Will be Removed on Sept 30, ...