All Apps and Add-ons

Universal Forwarder 5 and XenDesktop App

cramasta
Builder

Anyone else notice that the perfmon conf settings for the VDA's in the XenDesktop App don't work with the UF5 but they do with the 4.3.4 UF?

Ended up having to copy the contents out of the perfmon.conf file and copying/modifying it in the inputs.conf to get it to work. However the app is expecting the sourcetype to be named perfmon:CPULoad not perfmon://CPULoad

Inputs.conf

#[script://$SPLUNK_HOME\bin\scripts\splunk-perfmon.path]

#disabled = 0

#index = xendesktop_perfmon

[perfmon://CPULoad]

counters = % Processor Time;

disabled = 0

instances = _Total

interval = 10

object = Processor

index = xendesktop_perfmon

bosburn_splunk
Splunk Employee
Splunk Employee

Take a look at this - http://docs.splunk.com/Documentation/Splunk/5.0.1/Installation/Aboutupgradingto5.0READTHISFIRST#The_...

I'm willing to guess it's the same issue. The application will have to be updated.

gdavid
Path Finder

I am having similar problems. I only get script inputs right now. Now WMI, Perfmon, or Eventlogs.
i dont even see the attempts for WMI or Eventlogs

splunkd.log
INFO ExecProcessor - Ran script: "D:\Program Files\Splunk\bin\splunk-perfmon.exe" -index xendesktop_perfmon, took 98.64 milliseconds to run, 0 bytes read, exited with code -1
INFO ExecProcessor - Ran script: "D:\Program Files\Splunk\bin\splunk-perfmon.exe" -index xendesktop_perfmon, took 98.64 milliseconds to run, 0 bytes read, exited with code -1
INFO ExecProcessor - Ran script: "D:\Program Files\Splunk\bin\splunk-perfmon.exe" -index xendesktop_perfmon, took 50.78 milliseconds to run, 0 bytes read, exited with code -1
INFO ExecProcessor - Ran script: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe -command " &'D:\Program Files\Splunk\etc\apps\TA-XD-VDA\bin\powershell\GetClientDetails.ps1'" -index xendesktop, took 544.9 milliseconds to run, 247 bytes read
INFO ExecProcessor - Ran script: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe -command " &'D:\Program Files\Splunk\etc\apps\TA-XD-VDA\bin\powershell\GetICASessionStat.ps1'" -index xendesktop, took 1021.5 milliseconds to run, 2068 bytes read
INFO ExecProcessor - Ran script: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe -command " &'D:\Program Files\Splunk\etc\apps\TA-XD-VDA\bin\powershell\GetProcess.ps1'" -index xendesktop_winevents, took 3.647 seconds to run, 21200 bytes read

bsonposh
Communicator

I will look into this.

0 Karma
Get Updates on the Splunk Community!

Detecting Remote Code Executions With the Splunk Threat Research Team

REGISTER NOWRemote code execution (RCE) vulnerabilities pose a significant risk to organizations. If ...

Observability | Use Synthetic Monitoring for Website Metadata Verification

If you are on Splunk Observability Cloud, you may already have Synthetic Monitoringin your observability ...

More Ways To Control Your Costs With Archived Metrics | Register for Tech Talk

Tuesday, May 14, 2024  |  11AM PT / 2PM ET Register to Attend Join us for this Tech Talk and learn how to ...