Windows data you can collect with ITE Work

Collect metrics and log data with for Windows systems with a universal forwarder. You can use the data collection script or configure data collection agents manually. For more information, see these topics:

• Collect Windows metrics and logs with the data collection script in ITE Work
• Manually collect metrics from a Windows host in ITE Work
• Manually collect logs from a Windows host in ITE Work

If you haven't seen the requirements yet, see Windows integration requirements for ITE Work.

Metrics data

These are the host-identifying dimensions for each Windows host:

• host
• ip
• os
• os_version
• entity_type

These are the metrics collected, the default counters, and each source type for Windows hosts:

Metric	Counters	Source type
[perfmon://CPU]	% C1 Time  % C2 Time  % Idle Time  % Processor Time  % User Time  % Privileged Time  % Reserved Time  % Interrupt Time Interrupts/sec*	PerfmonMetrics:CPU
[perfmon://PhysicalDisk]	% Disk Read Time  % Disk Write Time Avg. Disk Queue Length  % Idle Time Avg. Disk Bytes/Read* Avg. Disk Bytes/Write*	PerfmonMetrics:PhysicalDisk
[perfmon://Network]	Bytes Received/sec Bytes Sent/sec Packets Received/sec Packets Sent/sec Packets Received Errors Packets Outbound Errors Current Bandwidth*	PerfmonMetrics:Network
[perfmon://Memory]	Cache Bytes  % Committed Bytes In Use Page Reads/sec Pages Input/sec Pages Output/sec Committed Bytes Available Bytes Available MBytes*	PerfmonMetrics:Memory
[perfmon://System]	Processor Queue Length Threads System Up Time	PerfmonMetrics:System
[perfmon://Process]	% Processor Time  % User Time  % Privileged Time Elapsed Time ID Process Virtual Bytes Working Set Private Bytes IO Read Bytes/sec IO Write Bytes/sec	PerfmonMetrics:Process
[perfmon://LogicalDisk]	Free Megabytes  % Free Space Avg. Disk sec/Transfer*	PerfmonMetrics:LogicalDisk

(*) Indicates counters that are required for the Content Pack for Monitoring Microsoft Windows.

Log data

The source type for all Windows log data is uf.

These are the logs a universal forwarder collects for each Windows host by default:

• $SPLUNK_HOMEvar\log\splunk\*.log*
• Application
• Security
• System
• Forwarded Events
• Setup