VMware ESXi and vSphere Cluster Management

Collect Windows Performance Counters in Splunk

Learn how to configure Splunk to collect Windows performance counters locally or remotely, choose objects, counters, and instances, and validate the data.

Windows Performance Monitor exposes measurements that describe the health and resource use of a Windows computer. Splunk can collect these measurements and make them searchable for troubleshooting, reporting, capacity planning, and alerting.

This lesson explains how to configure a local performance-monitoring input, how remote collection differs, and how to verify that the collected data is arriving in the expected index.

Prerequisites

Basic Splunk Web navigation.
familiarity with Splunk data inputs and indexes.
Understanding of Windows services and service accounts.
Basic Windows Performance Monitor and permissions knowledge.
Basic understanding of WMI for remote Windows administration.

How Windows performance counter collection works

Windows Performance Monitor is the Windows facility that exposes performance objects, counters, and instances. A performance counter is a numerical measurement of a Windows system or application resource. Splunk collects selected measurements at a defined interval and stores the resulting data for search and analysis.

Performance data can help you identify sustained CPU pressure, unusual disk activity, network load, or other system conditions. By detecting these conditions early, operations teams can investigate problems and help prevent service downtime.

Objects, counters, and instances

A performance object is a category containing related measurements. For example, the Processor object contains processor-related counters.

A counter is one particular measurement within the selected object. An instance identifies the component or target being measured, such as an individual processor, disk, process, or network interface.

Level	Meaning	Processor example
Object	A category that groups related counters.	Processor
Counter	A particular numerical measurement in the object.	Processor time
Instance	The specific target for the counter.	An individual processor
Aggregate instance	A combined value across applicable instances.	`_Total`, representing all processors

The object you select determines which counters and instances are available. If a desired measurement is not listed, first check whether it belongs to another object.

Local and remote performance monitoring

Local performance monitoring collects counters from the Windows computer on which the Splunk service is running. It is appropriate when the Splunk host itself is the system you want to monitor, or when a Splunk installation is placed directly on a Windows host for local collection.

Remote performance monitoring collects counters from another Windows computer through Windows management mechanisms. Remote collection requires network connectivity, suitable Windows management access, and an account that is authorized on the target computer.

Collection target	Where Splunk runs	Required service identity or account	Required access	Key consideration
Local Windows host	On the Windows host being monitored	Splunk must run as the built-in Local System user.	Local counter collection access provided through that service identity.	Verify the Splunk Windows service identity before creating the input.
Remote Windows host	On a different computer from the monitored host	Splunk must run under a domain account or suitable remote user account.	At least read access to Windows Management Instrumentation (WMI) on the target computer, plus working remote management connectivity.	Confirm the account and remote permissions before depending on the input.

Verify the Splunk service identity first

The service identity is operationally important because the same input can behave differently depending on which Windows account runs Splunk. For local collection, verify that the Splunk service runs as Local System. For remote collection, verify that it runs under a domain account or remote account with at least WMI read access on the target.

Do not assume that an administrator configuring Splunk Web is the identity used for collection. The Windows service identity is what determines the permissions available to the input.

Create a local performance-monitoring input

In Splunk Web, open Settings.
Open Data inputs.
Choose Local performance monitoring.
Create a new input or collection.
Provide a meaningful collection name.
Select one performance object.
Select the counters within that object.
Select the instances within that object.
Set the polling interval in seconds.
Choose the app context.
Set the host field value.
Choose the destination index.
Review the configuration and submit it.

Configuration fields

Field or selection	Purpose	Example	Configuration guidance
Collection name	Identifies the input configuration.	`local_processor_activity`	Use a descriptive name that explains the target and purpose.
Performance object	Chooses the category of measurements.	`Processor`	Select one object per input.
Counters	Chooses the measurements to collect.	Processor-related time counters	Select only the measurements needed for the monitoring objective.
Instances	Chooses the targets measured by the counters.	`_Total` or individual processors	Use an aggregate, individual targets, or both as appropriate.
Polling interval	Sets the seconds between collection attempts.	`60`	Balance data freshness, data volume, and system overhead.
App context	Sets the Splunk app scope in which the input is managed.	An infrastructure-monitoring app	Choose the context that matches ownership and administration practices.
Host value	Sets the Splunk metadata identifying the monitored Windows system.	`win-app-01`	Use a stable, consistent host identity.
Index	Specifies the Splunk data store destination.	`infra_metrics`	Align the choice with retention, access control, and monitoring practices.

Processor monitoring example

Suppose an administrator needs one view of total processor activity on the local Windows machine running Splunk.

Open Settings > Data inputs > Local performance monitoring.
Create a collection named something descriptive, such as local_processor_activity.
Choose the Processor object.
Select the processor-related counters required by the monitoring objective.
Select the _Total instance.
Set an appropriate polling interval, such as 60 seconds for a general operational view.
Choose the app context, consistent host value, and destination index.
Review and submit the input.
Search the selected index to confirm that records arrive.

The _Total instance represents combined processor activity across all applicable processors. It is useful for a single host-level view and for alerts based on overall processor pressure.

To compare individual processors, use the same Processor object and counters, but select specific processor instances instead of, or in addition to, _Total. The resulting data can be compared by instance to identify uneven or processor-specific activity.

Choose a polling interval

The polling interval is the number of seconds between performance data collection attempts. A shorter interval gives more detail about rapidly changing conditions, but it produces more data and can increase collection, storage, and search overhead.

A longer interval reduces volume and overhead but can hide short-lived spikes. Choose the interval based on how quickly the resource changes and how quickly the operations team needs to respond.

Use a shorter interval for conditions that change rapidly or require near-real-time investigation.
Use a moderate interval for ordinary infrastructure dashboards and trend monitoring.
Use a longer interval when the metric changes slowly and retention or ingestion volume is a concern.
Limit counters and instances to those needed for the operational question.

There is no single interval that fits every environment. Reassess the interval after reviewing data volume, dashboard usefulness, and system overhead.

App context, host value, and index design

App context

The app context is the Splunk app scope under which the input is created and managed. Selecting an appropriate context helps separate ownership and keeps related configuration with the team or application responsible for infrastructure monitoring.

Host value

The host field identifies the Windows system associated with the collected data. Set it to a stable value that users will recognize and use consistently in searches, dashboards, and reports. For remote collection, the host value should identify the monitored Windows computer rather than merely the Splunk collector, when that matches your data organization convention.

Index

An index is the Splunk data store used for retention, searching, and access control. Select an index whose retention period, permissions, and operational purpose match performance-monitoring data. A technically valid input can still be difficult to operate if its data is sent to an unexpected index.

Validate collected performance data

After submitting and enabling the input, search the configured destination index with a time range that includes the collection period. Start with a broad search against the selected index, then narrow the results using the configured host value and collection-related fields where available.

index=<destination_index> host=<configured_host>

Replace the placeholders with the actual index and host values from the input. Confirm all of the following:

Records or metrics are arriving in the selected index.
The host value identifies the expected Windows system.
The selected object, counters, and instances are represented.
Arrival times are approximately consistent with the configured polling interval.
The search time range includes the period after the input was submitted.

Once data is present, compare values by instance when individual processors, disks, interfaces, or other targets were selected. Use the data in searches, reports, dashboards, and threshold-based alerts appropriate to your monitoring design.

Prepare for remote counter collection

When a Splunk server must collect counters from another Windows computer, identify the account running the Splunk service before configuring the remote input. Use a domain account or other remote account suitable for access to the target host.

Identify the Windows service identity used by Splunk.
Confirm that it is a domain account or appropriate remote account rather than an identity that cannot access the target.
Verify that the account has at least read access to WMI on the remote Windows computer.
Verify that the target is reachable and available for remote Windows management.
Test the account's remote access before relying on the input for monitoring.

Remote collection is dependent on both authorization and connectivity. A correctly selected object or counter cannot produce data if the service account cannot read the target through WMI.

Troubleshooting

Local performance data does not appear

Verify that the Splunk Windows service runs as Local System.
Review the input in Settings > Data inputs and confirm that it was submitted and enabled.
Check the selected index, host value, and app context.
Search the configured index with a broad time range.
Confirm that the selected object, counters, and instances are valid on that Windows host.

Remote counters cannot be collected

Confirm the account used by the Splunk service.
Verify that the account is a suitable domain or remote account for the target.
Validate that the account has at least WMI read access on the remote computer.
Verify network reachability and remote Windows management availability.

Expected counters or instances are missing

Reconfirm the selected performance object.
Inspect the counters and instances exposed by Windows Performance Monitor on that host.
Check whether the desired metric belongs to a different object.
Create a separate input when another performance object is required.

One input cannot contain all desired metrics

If the desired metrics belong to multiple performance objects, this is expected behavior. Create one input for each required object and keep related counters and instances together where practical.

Data volume or overhead is too high

Increase the polling interval.
Reduce the number of selected counters.
Reduce the number of selected instances.
Review index growth and search usage after making changes.

Exam-relevant notes

Local counter collection requires Splunk to run as Local System.
Remote counter collection requires a domain or remote account and at least WMI read access on the target.
A performance object is a category; a counter is a measurement; an instance is the target of that measurement.
One performance input monitors only one performance object.
_Total is an aggregate instance, while named processor instances represent individual processors.
The polling interval controls the seconds between collection attempts and affects detail, volume, and overhead.
The index, host value, and app context determine how the collected data is organized and managed in Splunk.

Summary

Splunk can collect Windows Performance Monitor data by selecting an object, its counters, and its instances. For local collection, the Splunk service must run as Local System. For remote collection, it must use an account with suitable remote access and at least WMI read permissions on the target.

Configure the input from Settings > Data inputs > Local performance monitoring, set a useful interval and metadata, submit the input, and validate arrival in the selected index. Careful object selection, consistent host naming, appropriate index placement, and a workload-appropriate polling interval make the collected data easier to operate and analyze.

Continue with Windows performance counter collection when you need to review this workflow while planning additional performance inputs.