thank you ... View more

Thank you.   So the OOTB inputs.conf really does not have the basic perfmon stuff I was looking for.   Thank you for posting that and putting that to bed.     My search continues!! ... View more

As I said, in one of the replies here, I do not have admin rights.    I did look at that spec as well.    Someone said that the inputs.conf file in the install comes with samples and they just need to be enabled.  The spec definitely does not have that.     I was just hoping someone could paste the sample stanza.    Seems like a simple option.     ... View more

I downloaded  the tgz for the UCF.   I tried to extract the inputs.conf file but it returned that the inputs.conf file was not present.   I then downloaded the splunk tgz and got that inputs.conf file from it. Yes one responder was stating that I should extract the inputs.conf from the tgz which is not used for Windows, it's Linux.    I see where you are going in that why would the Linux inputs.conf file have windows perfmon stats.  Now I see that the tgz approach was not practical.   I was just hoping to get a sample stanza that captured Windows perform stats. That's was and still is my goal.   ... View more

Oh I thought it actually had sample counters.  I was hoping to use it as a jumping off point.   ... View more

Any chance you could post the stanza?  That would be much appreciated.  ... View more

I extracted the file which is great.   Maybe I am missing the Windows perfmon inputs in the default inputs.conf.     # Version 8.2.1 # DO NOT EDIT THIS FILE! # Changes to default files will be lost on update and are difficult to # manage and support. # # Please make any changes to system defaults by overriding them in # apps or $SPLUNK_HOME/etc/system/local # (See "Configuration file precedence" in the web documentation). # # To override a specific setting, copy the name of the stanza and # setting to the file where you wish to override it. # # This file contains possible attributes and values you can use to # configure inputs, distributed inputs and file system monitoring. [default] index = default _rcvbuf = 1572864 host = $decideOnStartup [blacklist:$SPLUNK_HOME/etc/auth] [blacklist:$SPLUNK_HOME/etc/passwd] [monitor://$SPLUNK_HOME/var/log/splunk] index = _internal [monitor://$SPLUNK_HOME/var/log/watchdog/watchdog.log*] index = _internal [monitor://$SPLUNK_HOME/var/log/splunk/license_usage_summary.log] index = _telemetry [monitor://$SPLUNK_HOME/var/log/splunk/splunk_instrumentation_cloud.log*] index = _telemetry sourcetype = splunk_cloud_telemetry [monitor://$SPLUNK_HOME/etc/splunk.version] _TCP_ROUTING = * index = _internal sourcetype=splunk_version [batch://$SPLUNK_HOME/var/run/splunk/search_telemetry/*search_telemetry.json] move_policy = sinkhole index = _introspection sourcetype = search_telemetry crcSalt = <SOURCE> log_on_completion = 0 [batch://$SPLUNK_HOME/var/spool/splunk] move_policy = sinkhole crcSalt = <SOURCE> [batch://$SPLUNK_HOME/var/spool/splunk/tracker.log*] index = _internal sourcetype = splunkd_latency_tracker move_policy = sinkhole [batch://$SPLUNK_HOME/var/spool/splunk/...stash_new] queue = stashparsing sourcetype = stash_new move_policy = sinkhole crcSalt = <SOURCE> time_before_close = 0 [batch://$SPLUNK_HOME/var/spool/splunk/...stash_hec] sourcetype = stash_hec move_policy = sinkhole crcSalt = <SOURCE> [fschange:$SPLUNK_HOME/etc] disabled = false #poll every 10 minutes pollPeriod = 600 #generate audit events into the audit index, instead of fschange events signedaudit=true recurse=true followLinks=false hashMaxSize=-1 fullEvent=false sendEventMaxSize=-1 filesPerDelay = 10 delayInMills = 100 [udp] connection_host=ip [tcp] acceptFrom=* connection_host=dns [splunktcp] route=has_key:_replicationBucketUUID:replicationQueue;has_key:_dstrx:typingQueue;has_key:_linebreaker:indexQueue;absent_key:_linebreaker:parsingQueue acceptFrom=* connection_host=ip [script] interval = 60.0 start_by_shell = true [SSL] # SSL settings # The following provides modern TLS configuration that guarantees forward- # secrecy and efficiency. This configuration drops support for old Splunk # versions (Splunk 5.x and earlier). # To add support for Splunk 5.x set sslVersions to tls and add this to the # end of cipherSuite: # DHE-RSA-AES256-SHA:AES256-SHA:DHE-RSA-AES128-SHA:AES128-SHA # and this, in case Diffie Hellman is not configured: # AES256-SHA:AES128-SHA sslVersions = tls1.2 cipherSuite = ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-SHA384:ECDHE-RSA-AES256-SHA384:ECDHE-ECDSA-AES128-SHA256:ECDHE-RSA-AES128-SHA256 ecdhCurves = prime256v1, secp384r1, secp521r1 allowSslRenegotiation = true sslQuietShutdown = false ... View more

I am on Windows so I don't even get a tar ball and I don't have admin rights anywhere to even run an install.   And I checked out the inputs.conf in the default directory and my predecessors did modify them!! ... View more

maybe I am just clueless but I could not extract the file ... View more

Any chance you have a copy?  I inherited this environment and don't have any place to install a universal forwarder.  All the inputs.conf have been "cleaned". ... View more