All Apps and Add-ons

Splunk App for Windows Infrastructure: Why is page_printed always 0 monitoring Windows print server?

barrycuda72
Explorer

I have followed this example to the letter. http://blogs.splunk.com/2014/04/21/windows-print-monitoring-in-splunk-6/
I am trying to use this to perform chargeback to departments. Everything seems to work with the exception that page_printed is always 0
Hard to do a chargeback when you can't see the total pages printed

fdarrigo
Path Finder

Hi. Do you know if this issue has been fixed? I configured my Windows 2008 R2 print server and I am receiving print events, however the page count metrics are wrong:
operation=add
type=PrintJob
printer="AMHMEMGeneralBW2"
machine="00ABMXV00402T1W"
user="fdarrigo"
document="Microsoft Word - Document1"
notify_name="fdarrigo"
JobId=58
data_type="RAW"
print_processor="hpcpp170"
parameters=
driver_name="HP Universal Printing PCL 5 (v5.9.0)"
status="spooling"
priority=1
total_pages=1
size_bytes=0
submitted_time="12/05/2016 15:09:16.951"
page_printed=0

This was for a 2 page Word document.

0 Karma

ahall_splunk
Splunk Employee
Splunk Employee

The field comes directly from the Printing API in use, so it's generated by Windows. On my Windows Server 2012 R2 print server, it's always filled in. However, your best bet is to look at the actual data - it may be that total_pages is the field you want. I'll do some tests next week and update the blog post if necessary.

0 Karma

thomasandersen
Engager

I have the same problem. The field total_pages, size_bytes, page_printed is all 0.

0 Karma

DimkoBilanko
Explorer

I have same problem.

I use:

  • Windows Server 2012R2 Splunk
  • Enterprise 6.4.4 Splunk
  • UniversalForwarder 6.4.4

Part of input.conf:

Print monitoring

[WinPrintMon://jobs]
type=job
interval=60
baseline=0
disabled=0

[WinPrintMon://printer]
type = printer
interval = 600
baseline = 1
disabled = 0
index = windows

[WinPrintMon://driver]
type = driver
interval = 600
baseline = 1
disabled = 0
index = windows

[WinPrintMon://port]
type = port
interval = 600
baseline = 1
disabled = 0
index = windows

0 Karma

infrastructure_
Explorer

Same problem here with Server 2008 and 2012R2.
Universal Forwarder 7.0.0

0 Karma
Get Updates on the Splunk Community!

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...

Let’s Get You Certified – Vegas-Style at .conf24

Are you ready to level up your Splunk game? Then, let’s get you certified live at .conf24 – our annual user ...