Troubleshoot the Windows entity integration in ITSI

Here are some common Windows integration issues and how to resolve them.

The Splunk universal forwarder isn't sending metrics data to Splunk

• Make sure the outputs.conf file on the universal forwarder is configured properly. Use the following Splunk CLI command to see active forwards:
  $SPLUNK_HOME/bin/splunk list forward-server
• Use the btool command to check inputs.conf perfmon configurations on the universal forwarder running on the monitored Windows machine. For more information, see Use btool to troubleshoot configurations in the Splunk Enterprise Troubleshooting Manual.

The following is a sample perfmon stanza:

[perfmon://CPU]
counters = % C1 Time;% C2 Time;% Idle Time;% Processor Time;% User Time;% Privileged Time
instances = *
interval = 30
mode = single
object = Processor
index = itsi_im_metrics
_meta = os::"Microsoft Windows Server 2012 R2 Standard" entity_type::Windows_Host
useEnglishOnly = true
sourcetype = PerfmonMetrics:CPU
disabled = 0

Mode, index, entity_type, _meta, and sourcetype are important fields. Most of the issues you might encounter are due to conflicts in the inputs.conf perfmon stanzas in the Splunk Add-on for Windows or other apps.

Windows metrics data in index but there are no entities in ITSI

• Make sure processor metrics are enabled and available for the monitored Windows host. Windows entity discovery uses the prefix Processor.* for metric names. Use mstats to look into metrics data. The metric_name in Splunk metrics index should look like this: Processor.%_Processor_Time.
• Make sure there's no data lag while indexing. If there's significant data lag, increase the monitoring_window for the [ITSI Import Objects - Perfmon] stanza in $SPLUNK_HOME/etc/apps/itsi/local/savedsearches.conf, then restart Splunk.
• Make sure data is indexed in the itsi_im_metrics index. If you're using a custom index, make sure the itsi_im_metrics_indexes macro is updated to include the custom index used. For more information, see Use custom indexes in ITSI.
• Verify that entity discovery saved searches are enabled for the [ITSI Import Objects - Perfmon] stanza in $SPLUNK_HOME/etc/apps/itsi/local/savedsearches.conf.

Entities appear but the overview dashboards aren't populated

Check the _meta fields within perfmon stanzas in inputs.conf and verify that entity_type::Windows_Host was added. See the sample inputs.conf file above.