Unable to ingest the performance metrics logs in splunk using the Splunk Add-on for Microsoft Windows.

Applicability

Description

With Splunk version 9.0.5.1, Splunk Universal Forwarder version 7.2.0; Users might unable to receive metric data using the Splunk Add-on for Microsoft Windows version 8.8.0.

Below are the error observed from Splunk Universal Forwarder:

The metric event is not properly structured, source=ProcessorInformation, sourcetype=ProcessorInformation, host=XXXXX, index=perfmon. Metric event data without a metric name and properly formated numerical values are invalid and cannot be indexed. Ensure the input metric data is not malformed, have one or more keys of the form "metric_name:<metric>" (e.g..."metric_name:cpu.idle") with corresponding floating point values.

Investigation

In investigation, it was observed that the error was due to a Splunk Universal forwarder version compatibility with the metric collection functionality in the latest version of the Splunk Add-on for Microsoft Windows. The addon was observed to be working fine in Splunk Universal Forwarder v9.x, but not in version 7.x.

Resolution

Splunk universal Forwarder version 7.x is out of support as mentioned in this documentation. Furthermore, Splunk Universal Forwarder version 8.8.0 is Compatible with version 8.1.x, 8.2.x, 9.0.x (Reference document attached here). Hence, it is recommended to upgrade the Splunk Universal Forwarder to the latest version supported by Splunk addon for Microsoft Windows.