Splunk® Content Packs for ITSI and IT Essentials Work

Splunk Content Packs for ITSI and IT Essentials Work

Acrobat logo Download manual as PDF

Acrobat logo Download topic as PDF

Install and configure the Content Pack for Monitoring Microsoft Windows

Perform the following high-level steps to configure the Content Pack for Monitoring Microsoft Windows:

  1. Install the content pack on your ITSI search head.
  2. Create a search macro that includes all indexes you're using for data collection.
  3. Enable entity discovery to automatically discover entities for which relevant data has been collected.
  4. Tune KPI base searches
  5. Tune KPI threshold levels.


Step 1: Install the content pack

If you're a Splunk Cloud Platform customer, you can install the content pack directly through the ITSI Content Library in a future release. You can also install content packs through the ITSI REST API. If you're an on-premises customer on a version lower than 4.8.0, see Install the content pack in an on-premises instance.

Install the content pack through the REST API

On ITSI version 4.8.x you can use the itoa_interface/content_pack endpoint to install content packs through the ITSI REST API. The endpoint includes GET operations to fetch versioning information and preview the contents of the content pack, and a POST operation to install content packs.

Install the content pack on an on-premises instance

Perform the following steps to install the content pack:

  1. Download the following ITSI backup file: BACKUP-CP-WIN-OS-1.0.1.zip.
  2. On your ITSI search head, create a restore job and upload the backup file. For instructions, see Restore from a backup zip file.
  3. After the restore job completes, confirm that the objects included in the content pack are restored to your environment.

Step 2: Create the index search macro

If you're not collecting data in the default indexes given by the Splunk Add-on for Microsoft Windows, you need to create a new macro with the indexes that you're using for data collection.


  • You must have the admin role to create the index search macro.
  • You must know the indexes your organization uses to send data to your Splunk platform deployment using the Splunk Add-on for Microsoft Windows.


  1. From Splunk Web, click Settings > Advanced Search > Search Macros.
  2. Click New Search Macro.
  3. Configure the following fields:
    Field Value
    Destination app itsi
    Name itsi-cp-windows-indexes
    Definition All of the indexes that you're using for data collection from add-ons combined with OR operators.

    For example:

    (index=windows OR index=perfmon OR index=<index-name>)
  4. Click Save.
  5. Configure read/write permissions for the macro:
    1. For the newly created macro, click Permissions.
    2. Select All apps (system).
    3. Give Read access to Everyone.
    4. Give Write access to admin.
    5. Click Save.

Step 3: Enable automatic entity discovery

Perform the following steps to ensure that ITSI automatically detects your Microsoft Windows hosts. For best results, perform these steps after you configure one or more hosts to send data to Splunk.

  1. Navigate to ITSI on the search head.
  2. Click Configuration > Entities.
  3. Click Create Entity > Import from Search.
  4. Select Ad hoc search and enter the following search:

    `itsi-cp-windows-indexes` sourcetype=WinHostMon | eval role="operating_system_host" | stats latest(family) as family, latest(version) as version, latest(vendor_product) as vendor_product, latest(role) as itsi_role, latest(cpu_cores) as cpu_cores, latest(mem) as memory, latest(cpu_architecture) as cpu_architecture by host | fields + host, family, version, vendor_product, itsi_role, cpu_cores, memory, cpu_architecture

  5. Click the search icon to run the search and confirm that one or more hosts are shown with all columns populated.
  6. Click Next.
  7. In the Import Column As column, set the host field to Entity Title. Set all other fields to Entity Information Field.
  8. Set Conflict Resolution to Update Existing Entities and set the Conflict Resolution Field to host.
  9. Click Import.
  10. After the import completes, click Set up Recurring Import.
  11. Name the recurring import ITSI discovery of Windows servers
  12. Set the frequency based on the needs of your deployment. Use Run on cron Schedule for maximum flexibility.
  13. Click Submit. ITSI creates the new modular input in $SPLUNK_HOME/etc/apps/itsi/local/inputs.conf.

Step 4: Tune KPI base searches

This content pack ships with the following KPI base searches:

  • OS:Performance.WIN.CPU
  • OS:Performance.WIN.LogicalDisk
  • OS:Performance.WIN.Memory
  • OS:Performance.WIN.Network
  • OS:Performance.WIN.PhysicalDisk
  • OS:Performance.WIN.Process
  • OS:Performance.WIN.System
  • OS:Performance.WIN.WinHostMon

Each search runs every five minutes with a 5 minute calculation window, and uses only the latest value on a per-entity basis. The 5 minute calculation window ensures that you won't see N/A for less frequent data. Using the latest value means that the KPI status refreshes as quickly as possible for data collected more frequently.

You must review and tune all base searches to run at a frequency that matches your data collection interval.

Step 5: Tune KPI thresholds

Aggregate KPI thresholds use Normal, Medium, and Low levels, while per-entity thresholds except for available disk space don't exceed Medium. Lower threshold levels for OS-level monitoring allow application-level KPIs to take a more prominent threshold level. For example, a server at 100% CPU isn't a critical issue if the apps running on that server are responding normally.

Aggregate threshold values are calculated for general use only. You must tune these threshold values according to your environment. For more information, see Overview of creating KPIs in ITSI in the Service Insights manual.

Last modified on 21 July, 2021
Data requirements for the Content Pack for Monitoring Microsoft Windows
Use the Content Pack for Monitoring Microsoft Windows

This documentation applies to the following versions of Splunk® Content Packs for ITSI and IT Essentials Work: current

Was this documentation topic helpful?

You must be logged into splunk.com in order to post comments. Log in now.

Please try to keep this discussion focused on the content covered in this documentation topic. If you have a more general question about Splunk functionality or are experiencing a difficulty with Splunk, consider posting a question to Splunkbase Answers.

0 out of 1000 Characters