Advanced configuration for Windows

Send Windows metrics to the Splunk platform

Use the Windows installer script to collect host metrics with the Collector and send them to Splunk Enterprise or Splunk Cloud Platform.

Prerequisites

• A running Splunk Enterprise or Splunk Cloud Platform deployment.

• A Splunk HEC token with write access to the target metrics index. For more information, see Use HTTP Event Collector.

• A metrics index in Splunk Enterprise or Splunk Cloud Platform. For more information, see Get started with metrics.

• Splunk Distribution of OpenTelemetry Collector v0.157.0 or higher.

Install the Collector with metrics collection enabled

Pass the Splunk HEC endpoint URL, token, and target metrics index to the installer by using msi_public_properties.

& {
  Set-ExecutionPolicy Bypass -Scope Process -Force
  $script = (New-Object System.Net.WebClient).DownloadString('https://dl.observability.splunkcloud.com/splunk-otel-collector.ps1')

  $params = @{
    msi_public_properties = "SPLUNK_PLATFORM_URL=<URL> SPLUNK_PLATFORM_TOKEN=<TOKEN> SPLUNK_PLATFORM_METRICS_INDEX=<INDEX>"
  }
  & ([scriptblock]::Create($script)) @params
}

To also send metrics and traces to Splunk Observability Cloud, include your Splunk Observability Cloud access token and realm:

& {
  Set-ExecutionPolicy Bypass -Scope Process -Force
  $script = (New-Object System.Net.WebClient).DownloadString('https://dl.observability.splunkcloud.com/splunk-otel-collector.ps1')

  $params = @{
    access_token = "<ACCESS_TOKEN>"
    realm = "<REALM>"
    msi_public_properties = "SPLUNK_PLATFORM_URL=<URL> SPLUNK_PLATFORM_TOKEN=<TOKEN> SPLUNK_PLATFORM_METRICS_INDEX=<METRICS_INDEX>"
  }
  & ([scriptblock]::Create($script)) @params
}

Installer options

Use these MSI public properties to send Windows metrics to the Splunk platform:

Collected metrics

By default, the Collector uses the windowsperfcounters receiver to collect system metrics from the Windows host. Metrics collected by default come from performance counter objects such as Processor, Processor Information, LogicalDisk, PhysicalDisk, Memory, Network Interface, Process, System, DFS Replicated Folders, NTDS, and DNS.

For more information about the receiver, see Windows Performance Counters receiver.

Activate or deactivate performance counters

1. Edit C:\ProgramData\Splunk\OpenTelemetry Collector\splunk_metrics_config_windows.yaml and comment, uncomment, or add counters:

   YAMLCopy

   windowsperfcounters/cpu: collection_interval: 10s perfcounters: - object: Processor instances: ["*"] counters: - name: "% Processor Time" - name: "% User Time" - name: "% Privileged Time" - name: "Interrupts/sec" - name: "% DPC Time" - name: "% Interrupt Time"

   windowsperfcounters/cpu:
     collection_interval: 10s
     perfcounters:
       - object: Processor
         instances: ["*"]
         counters:
           - name: "% Processor Time"
           - name: "% User Time"
           - name: "% Privileged Time"
           - name: "Interrupts/sec"
           - name: "% DPC Time"
           - name: "% Interrupt Time"

2. Restart the Collector service:

   POWERSHELLCopy

   Restart-Service splunk-otel-collector

   Restart-Service splunk-otel-collector

Verify metrics ingestion

Run a metrics search in Splunk Cloud Platform or Splunk Enterprise to confirm that metrics are arriving in the target index:

| mpreview index="<your-index>"

Change the default configuration file for the Collector for Windows

All installation methods offer default configurations using environment variables. Before starting the splunk-otel-collector service, replace the variables in the default configuration file with the appropriate values for your environment.

Based on the specified installation parameters, the environment variables are saved to the HKLM:\SYSTEM\CurrentControlSet\Services\splunk-otel-collector registry key and set on the Environment entry.

To modify any of the configuration values, run regedit and browse to the path.

Use the following environment variables to send Windows logs and metrics to the Splunk platform:

Configure account rights for least privilege on Windows

To harden the collector deployment, run the collector under a service account with these privileges:

• SeServiceLogonRight - required to launch the service.

• SeBackupPrivilege - gives the service access to all files on the system.

• SeSecurityPrivilege - gives the service access to the security logs and audit events.

In addition, give the service account the following memberships:

• Performance Monitor Users (domain group) - gives the service account the ability to monitor performance counters.

Configure memory allocation

To configure memory allocation, use the memory parameter, which sets the environment variable SPLUNK_MEMORY_TOTAL_MIB.

• By default, the Collector is configured to use 512 MiB of memory.

• To modify this setting, replace SPLUNK_MEMORY_TOTAL_MIB with the desired integer value.

& {Set-ExecutionPolicy Bypass -Scope Process -Force; $script = ((New-Object System.Net.WebClient).DownloadString('https://dl.observability.splunkcloud.com/splunk-otel-collector.ps1')); $params = @{access_token = "SPLUNK_ACCESS_TOKEN"; realm = "SPLUNK_REALM"; memory = "SPLUNK_MEMORY_TOTAL_MIB"}; Invoke-Command -ScriptBlock ([scriptblock]::Create(". {$script} $(&{$args} @params)"))}

Read more about Collector sizing in Sizing and scaling.

Configure proxy settings

To configure proxy settings to install and run the OpenTelemetry Collector, see Configure proxy settings for the Collector.

Command line options

To add or remove command line options for the splunk-otel-collector service, run regedit and modify the ImagePath value in the HKLM:\SYSTEM\CurrentControlSet\Services\splunk-otel-collector registry key.

Alternatively, run the following PowerShell command, replacing OPTIONS with the desired command line options:

Set-ItemProperty -path "HKLM:\SYSTEM\CurrentControlSet\Services\splunk-otel-collector" -name "ImagePath" -value "C:\Program Files\Splunk\OpenTelemetry Collector\otelcollauncher.exe OPTIONS"

For example, to change the default exposed metrics address of the Collector to 0.0.0.0:9090, run the following PowerShell command:

Set-ItemProperty -path "HKLM:\SYSTEM\CurrentControlSet\Services\splunk-otel-collector" -name "ImagePath" -value "C:\Program Files\Splunk\OpenTelemetry Collector\otelcollauncher.exe --metrics-addr 0.0.0.0:9090"

Use multiple configuration files

When you provide multiple configuration files, add the --feature-gates=confmap.enableMergeAppendOption option to the Collector command line.

& 'C:\Program Files\Splunk\OpenTelemetry Collector\otelcol.exe' `
  --config 'C:\ProgramData\Splunk\OpenTelemetry Collector\agent_config.yaml' `
  --config 'C:\ProgramData\Splunk\OpenTelemetry Collector\splunk_logs_config_windows.yaml' `
  --config 'C:\ProgramData\Splunk\OpenTelemetry Collector\splunk_metrics_config_windows.yaml' `
  --feature-gates=confmap.enableMergeAppendOption

Apply the changes

After modifying the configuration file or registry key, apply the changes by restarting the system or running the following PowerShell commands:

Stop-Service splunk-otel-collector
Start-Service splunk-otel-collector

Available command line options

To see all available command line options, run the following PowerShell command:

& 'C:\Program Files\Splunk\OpenTelemetry Collector\otelcol.exe' --help