diff --git a/deployment-apps/02-M-TIC_idx_indexes_base/default/indexes.conf b/deployment-apps/02-M-TIC_idx_indexes_base/default/indexes.conf index d052703f..df96299a 100755 --- a/deployment-apps/02-M-TIC_idx_indexes_base/default/indexes.conf +++ b/deployment-apps/02-M-TIC_idx_indexes_base/default/indexes.conf @@ -85,6 +85,8 @@ repFactor = auto [perfmon] #maxHotBuckets = 10 +[winmetrics] + [winevents] #maxHotBuckets = 10 diff --git a/deployment-apps/TA_Distinct_Performance_Inputs/.DS_Store b/deployment-apps/TA_Distinct_Performance_Inputs/.DS_Store new file mode 100644 index 00000000..c435868b Binary files /dev/null and b/deployment-apps/TA_Distinct_Performance_Inputs/.DS_Store differ diff --git a/deployment-apps/TA_Distinct_Performance_Inputs/bin/README b/deployment-apps/TA_Distinct_Performance_Inputs/bin/README new file mode 100755 index 00000000..76199287 --- /dev/null +++ b/deployment-apps/TA_Distinct_Performance_Inputs/bin/README @@ -0,0 +1 @@ +This is where you put any scripts you want to add to this app. diff --git a/deployment-apps/TA_Distinct_Performance_Inputs/default/app.conf b/deployment-apps/TA_Distinct_Performance_Inputs/default/app.conf new file mode 100755 index 00000000..e59d47c7 --- /dev/null +++ b/deployment-apps/TA_Distinct_Performance_Inputs/default/app.conf @@ -0,0 +1,19 @@ +# +# Splunk app configuration file +# + +[install] +is_configured = 0 + +[ui] +is_visible = 0 +label = Distinct Performance Inputs + +[launcher] +author = Dwayne Geffroy +description = Set of inputs for monitoring inputs in the distinct performance app +version = 1.0.0 + +[package] +id = TA_Distinct_Performance_Inputs +check_for_updates = 1 \ No newline at end of file diff --git a/deployment-apps/TA_Distinct_Performance_Inputs/default/data/ui/nav/default.xml b/deployment-apps/TA_Distinct_Performance_Inputs/default/data/ui/nav/default.xml new file mode 100755 index 00000000..411539c0 --- /dev/null +++ b/deployment-apps/TA_Distinct_Performance_Inputs/default/data/ui/nav/default.xml @@ -0,0 +1,7 @@ + diff --git a/deployment-apps/TA_Distinct_Performance_Inputs/default/data/ui/views/README b/deployment-apps/TA_Distinct_Performance_Inputs/default/data/ui/views/README new file mode 100755 index 00000000..d518a88b --- /dev/null +++ b/deployment-apps/TA_Distinct_Performance_Inputs/default/data/ui/views/README @@ -0,0 +1 @@ +Add all the views that your app needs in this directory diff --git a/deployment-apps/TA_Distinct_Performance_Inputs/default/inputs.conf b/deployment-apps/TA_Distinct_Performance_Inputs/default/inputs.conf new file mode 100755 index 00000000..6f857bd3 --- /dev/null +++ b/deployment-apps/TA_Distinct_Performance_Inputs/default/inputs.conf @@ -0,0 +1,64 @@ +## CPU +[perfmon://CPU] +counters = % Processor Time; % User Time; % Privileged Time; Interrupts/sec; % DPC Time; % Interrupt Time; DPCs Queued/sec; DPC Rate; % Idle Time; % C1 Time; % C2 Time; % C3 Time; C1 Transitions/sec; C2 Transitions/sec; C3 Transitions/sec +disabled = 0 +instances = * +interval = 10 +mode = single +object = Processor +useEnglishOnly=true +index=winmetrics + +## Logical Disk +[perfmon://LogicalDisk] +counters = % Free Space; Free Megabytes; Current Disk Queue Length; % Disk Time; Avg. Disk Queue Length; % Disk Read Time; Avg. Disk Read Queue Length; % Disk Write Time; Avg. Disk Write Queue Length; Avg. Disk sec/Transfer; Avg. Disk sec/Read; Avg. Disk sec/Write; Disk Transfers/sec; Disk Reads/sec; Disk Writes/sec; Disk Bytes/sec; Disk Read Bytes/sec; Disk Write Bytes/sec; Avg. Disk Bytes/Transfer; Avg. Disk Bytes/Read; Avg. Disk Bytes/Write; % Idle Time; Split IO/Sec +disabled = 0 +instances = * +interval = 10 +mode = single +object = LogicalDisk +useEnglishOnly=true +index=winmetrics + +[perfmon://Memory] +counters = Page Faults/sec; Available Bytes; Committed Bytes; Commit Limit; Write Copies/sec; Transition Faults/sec; Cache Faults/sec; Demand Zero Faults/sec; Pages/sec; Pages Input/sec; Page Reads/sec; Pages Output/sec; Pool Paged Bytes; Pool Nonpaged Bytes; Page Writes/sec; Pool Paged Allocs; Pool Nonpaged Allocs; Free System Page Table Entries; Cache Bytes; Cache Bytes Peak; Pool Paged Resident Bytes; System Code Total Bytes; System Code Resident Bytes; System Driver Total Bytes; System Driver Resident Bytes; System Cache Resident Bytes; % Committed Bytes In Use; Available KBytes; Available MBytes; Transition Pages RePurposed/sec; Free & Zero Page List Bytes; Modified Page List Bytes; Standby Cache Reserve Bytes; Standby Cache Normal Priority Bytes; Standby Cache Core Bytes; Long-Term Average Standby Cache Lifetime (s) +disabled = 0 +interval = 10 +instances = * +mode = single +object = Memory +useEnglishOnly=true +index=winmetrics + +[perfmon://Network] +counters = Bytes Total/sec; Packets/sec; Packets Received/sec; Packets Sent/sec; Current Bandwidth; Bytes Received/sec; Packets Received Unicast/sec; Packets Received Non-Unicast/sec; Packets Received Discarded; Packets Received Errors; Packets Received Unknown; Bytes Sent/sec; Packets Sent Unicast/sec; Packets Sent Non-Unicast/sec; Packets Outbound Discarded; Packets Outbound Errors; Output Queue Length; Offloaded Connections; TCP Active RSC Connections; TCP RSC Coalesced Packets/sec; TCP RSC Exceptions/sec; TCP RSC Average Packet Size +disabled = 0 +instances = * +interval = 10 +mode = single +object = Network Interface +useEnglishOnly=true +index=winmetrics + +## System +[perfmon://System] +counters = File Read Operations/sec; File Write Operations/sec; File Control Operations/sec; File Read Bytes/sec; File Write Bytes/sec; File Control Bytes/sec; Context Switches/sec; System Calls/sec; File Data Operations/sec; System Up Time; Processor Queue Length; Processes; Threads; Alignment Fixups/sec; Exception Dispatches/sec; +disabled = 0 +instances = * +interval = 10 +mode = single +object = System +useEnglishOnly=true +index=winmetrics + +## System +[perfmon://PagingFile] +counters = % Usage +disabled = 0 +instances = * +interval = 10 +mode = single +object = Paging File +useEnglishOnly=true +index=winmetrics + diff --git a/deployment-apps/TA_Distinct_Performance_Inputs/default/props.conf b/deployment-apps/TA_Distinct_Performance_Inputs/default/props.conf new file mode 100755 index 00000000..94f60768 --- /dev/null +++ b/deployment-apps/TA_Distinct_Performance_Inputs/default/props.conf @@ -0,0 +1,8 @@ +[Perfmon:PagingFile] +TRANSFORMS-_value_for_perfmon_metrics_store = value_for_perfmon_metrics_store +TRANSFORMS-metric_name_for_perfmon_metrics_store = metric_name_for_perfmon_metrics_store +TRANSFORMS-object_for_perfmon_metrics_store = object_for_perfmon_metrics_store +TRANSFORMS-instance_for_perfmon_metrics_store = instance_for_perfmon_metrics_store +TRANSFORMS-collection_for_perfmon_metrics_store = collection_for_perfmon_metrics_store +EVAL-metric_type = "gauge" + diff --git a/deployment-apps/TA_Distinct_Performance_Inputs/metadata/default.meta b/deployment-apps/TA_Distinct_Performance_Inputs/metadata/default.meta new file mode 100755 index 00000000..91f9bb39 --- /dev/null +++ b/deployment-apps/TA_Distinct_Performance_Inputs/metadata/default.meta @@ -0,0 +1,35 @@ + +# Application-level permissions + +[] +access = read : [ * ], write : [ admin, power ] + +### EVENT TYPES + +[eventtypes] +export = system + + +### PROPS + +[props] +export = system + + +### TRANSFORMS + +[transforms] +export = system + + +### LOOKUPS + +[lookups] +export = system + + +### VIEWSTATES: even normal users should be able to create shared viewstates + +[viewstates] +access = read : [ * ], write : [ * ] +export = system diff --git a/deployment-apps/TA_Distinct_Performance_Inputs/splunkbase.manifest b/deployment-apps/TA_Distinct_Performance_Inputs/splunkbase.manifest new file mode 100644 index 00000000..563b49f7 --- /dev/null +++ b/deployment-apps/TA_Distinct_Performance_Inputs/splunkbase.manifest @@ -0,0 +1,60 @@ +{ + "version": "1.0", + "date": "2022-11-14T23:36:05.346500098Z", + "hashAlgorithm": "SHA-256", + "app": { + "id": 5679, + "version": "1.0.0", + "files": [ + { + "path": "bin/README", + "hash": "eaaa0ae11a829d5492934487b9628ba841d2678941afc4d979dee5ff19b7adbb" + }, + { + "path": "default/app.conf", + "hash": "c38f506417fb4441c4ec2615fc2ee569a3aae605091a8a43af2b371b8f0ee722" + }, + { + "path": "default/data/ui/nav/default.xml", + "hash": "9b34df293ca5ade6bcd0d0437fd2b7170be0780e61303d265160a3ed3ba3a9ea" + }, + { + "path": "default/data/ui/views/README", + "hash": "f75000f12510d242fc99decea9e7e5a46a1a8bef910d3d6f741797816b35034d" + }, + { + "path": "default/inputs.conf", + "hash": "d83f691761a4153f24d9cd9698a1135a80c571a198d14d93e4dba09c2eb4e73b" + }, + { + "path": "default/props.conf", + "hash": "5f94084e20f8da8a22df86ec5e78da1cf3b695e5c5b64247f891dbffc6d529a3" + }, + { + "path": "metadata/default.meta", + "hash": "74de976ad72c882a6fa261a1c54670b879cbf0f611c8da9159a298f900b68b35" + } + ] + }, + "products": [ + { + "platform": "splunk", + "product": "enterprise", + "versions": [ + "7.2", + "7.3" + ], + "architectures": [ + "x86_64" + ], + "operatingSystems": [ + "windows", + "linux", + "macos", + "freebsd", + "solaris", + "aix" + ] + } + ] +} \ No newline at end of file