SSSK – 1 – Stuff Splunkers Should Know – Perfmon / WMI collection in 4.2

Greetings Splunkers.  Today I finally executed on an idea I have had for a while to do a series (video) on just “stuff i think splunk users might need to know”.  Whatever comes to mind, i’ll try to just dump it out of my head on video.
The first episode covers some changes you might not be aware of (for the better) in how Splunk 4.2 collects WMI/PerfMon counter data from Windows.  (Issue: It causes the Splunk for Windows app to behave abnormally).  The way data is structured now is actually better and more predictable.
I’m posting these on youtube under the “splunkninja” account.  Subscribe on Youtube for notification of new videos if you like.  Check it out!  Feedback to “thewilde AT”

Michael Wilde

Posted by