This is very strange issue I am experiencing with Spunk 6.2.1. I have SplunkUniversalForwarder setup on Windows 2008 (R2) box.
/apps/Splunk_TA_Windows/local/inputs.conf config file contains following stanzas. However, with sourcetypes Perfmon:System or Perfmon:Process, I am not getting any data in Splunk. If I change the stanza name and replace Process with say WinProcess and System with WinSystem, then I get the data with sourcetypes Perfmon:WinProcess and Perfmon:WinSystem. I am not sure whats going wrong here when I use stanza name to have System or Process.
Please help. In one Answers post:
http://answers.splunk.com/answers/113708/performance-monitoring-not-working-on-windows-app.html
I read that we should have stanza names to have Windows__ prefix. But I don't think its mandatory to have stanza names like that.
Example stanza NOT working:
[perfmon://System]
counters = *
instances = *
interval = 120
object = System
disabled = 0
[perfmon://Process]
counters = *
instances = *
interval = 120
object = Processor
disabled = 0
Example stanza working:
[perfmon://WinSystem]
counters = *
instances = *
interval = 120
object = System
disabled = 0
[perfmon://WinProcess]
counters = *
instances = *
interval = 120
object = Processor
disabled = 0
Try to access Windows performance monitor and check the names of the counter.Might be Windows 2008 has different counter names.