Getting Data In

How to disable Perfmon

eantonio
Path Finder

I created a batch file to install the Splunk UF:

msiexec /i splunkforwarder64bit.msi
RECEIVING_INDEXER="SERVER NAME:9997"
AGREETOLICENSE=Yes
INSTALLDIR="C:\Program Files\Splunk"
DEPLOYMENT_SERVER="SERVER NAME"
LAUNCHSPLUNK=1
SERVICESTARTTYPE=auto
WINEVENTLOG_APP_ENABLE=1
WINEVENTLOG_SEC_ENABLE=1
WINEVENTLOG_SYS_ENABLE=1
PERFMON=cpu
PERFMON=memory
PERFMON=network
PERFMON=diskspace
/quiet

I don't want the UF to send me PERFMON data anymore. How do I disable/remove it from happening?

Thank you for you help.

Tags (3)

_d_
Splunk Employee
Splunk Employee

I think if you remove the following:

PERFMON=cpu
PERFMON=memory
PERFMON=network
PERFMON=diskspace

from your command above you'll disable perfmon inputs. Alternatively, in the perfmon.conf file (of your UFs) add disabled = 1 under each stanza.

Hope this helps

> please upvote and accept answer if you find it useful - thanks!

eantonio
Path Finder

Is there a setting in Splunk Instance or Splunk Web UI to disable the collection of Perfmon data? That way, I dont have to go to each of my remote UF to disable Perfmon.

0 Karma

eantonio
Path Finder

Is there a setting in Splunk Instance or Splunk Web UI to disable the collection of Perfmon data? That way, I dont have to go to each of my remote UF to disable Perfmon.

eantonio
Path Finder

I don't see any perfmon.conf. If I will create a new file for this, do I just enter "disabled = 1" and save the file in the $SPLUNK_HOME\etc\system\local\ folder?

0 Karma

_d_
Splunk Employee
Splunk Employee

There is a perfmon.conf in $SPLUNK_HOME\etc\system\default\ but do not edit this. To set custom
configurations, place a modified perfmon.conf in $SPLUNK_HOME\etc\system\local\. You can also search your $SPLUNK_HOME directory (Normally C:\Program Files\SplunkUniversalForwarder) for filename perfmon.conf to get the exact location.

0 Karma

eantonio
Path Finder

where do I find the perfmon.conf file on my UF installation?

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...