I'm using the universal forwarder (4.2.3) to forward from windows servers to a linux splunk host ( 4.2.3, build 105575).
I've installed the windows app but it does nothing with the perfmon data received from the windows host IE. data does noet show up in the performance view. I can search for sourcetype="Perfmon:Free Disk Space" and I find loads of data.
Hi HansK,
It is very likely that the Windows App is still wired to use the old WMI method of capturing data from Windows machines. i.e. the app expects wmi sourcetypes/sources instead of perfmon.
Check this out for more info:
http://blogs.splunk.com/2011/04/20/sssk-1-stuff-splunkers-should-know-perfmon-wmi-collection-in-4-2/
Best,
d.
Hi HansK,
It is very likely that the Windows App is still wired to use the old WMI method of capturing data from Windows machines. i.e. the app expects wmi sourcetypes/sources instead of perfmon.
Check this out for more info:
http://blogs.splunk.com/2011/04/20/sssk-1-stuff-splunkers-should-know-perfmon-wmi-collection-in-4-2/
Best,
d.