How could config Windows Performance Management?

[ITSD]

I'd install Universal Forwarder on windows and froward wmi events to index server (Linux server). But I see "No results found". Where did I missed?

[ITSD]

I found another answer through Takajian's answer:

http://splunk-base.splunk.com/answers/23901/windows-app-on-linux-indexer

Steps as follow:

1. Install Universal Forwarder
2. Put wmi.conf in C:\Program Files\SplunkUniversalForwarder\etc\system\local (By default)
3. Restart Splunk UF

[Takajian · Accepted solution]

As for performance, there are four dashboads in Win App. The folder is default/data/ui/view.

cpu_view.xml
disk_view.xml
mem_view.xml
network_view.xml

Then each view have setting which source will display.

As for network, there are two searches to display report.

dash_wmidata(LocalNetwork) host=$host$| timechart avg(eval(BytesReceivedPersec/1024)) as Received avg(eval(BytesSentPersec/1024)) as Sent
dash_wmidata(LocalNetwork) | timechart avg(eval(BytesTotalPersec/1024)) by host limit=10 usenull=f

These contains "BytesReceivedPersec" and "BytesTotalPersec". It means you need to collect these object from Universal forwarder in order to display those values on the dashboard.

Please check them in your environment.

[Takajian]

Did you install UF with Windows Local system user? If no, splunk user will require following permission.

Permission to log on as a service
Permission to log on as a batch job
Permission to replace a process-level token
Permission to act as part of the operating system
Permission to bypass traverse checking

Addtion to this, please check if there is any wmi error in splunkd.log under $SPLUNK_HOME/var/log/splunk.

[ITSD]

Because I'd use windows APPS from Splunk. Right now I want use it's dashboard to monitor performance. How could I config it ? Thanks again:D

[Takajian]

You seems to see Windows performance events properly. What is problem now? Could you explain what you can see and what you can not see?

[ITSD]

I can see follow events:
PM 11/14/2011 14:53:50.370collection="Network Interface"object="Network Interface"counter="Bytes Received/sec"instance="Intel[R] PRO_1000 MT Network Connection"Value=332.00027378610179
host=APYTEST Options| sourcetype=Perfmon:Network Interface Options| source=Perfmon:Network Interface Options

But Can't shawn in dashboard , any ideas? Thanks

[Takajian]

There are many things you need to check. Following two issues are most freaquent splunk users face. Could you check?

• Did you configure received port on splunk indexer? The port may be 9997.
• Is there no network conectivity issue between indexer and universal forwarder?

[ITSD]

Sorry for not cleared describe it. I can see windows events. But can not see performance events. Thanks for your answer.