Getting Data In

Why Windows perfmon sourcetypes with stanza names "Perfmon:System" and "Perfmon:Process" do not get any data?

caagrawal
New Member

This is very strange issue I am experiencing with Spunk 6.2.1. I have SplunkUniversalForwarder setup on Windows 2008 (R2) box.

/apps/Splunk_TA_Windows/local/inputs.conf config file contains following stanzas. However, with sourcetypes Perfmon:System or Perfmon:Process, I am not getting any data in Splunk. If I change the stanza name and replace Process with say WinProcess and System with WinSystem, then I get the data with sourcetypes Perfmon:WinProcess and Perfmon:WinSystem. I am not sure whats going wrong here when I use stanza name to have System or Process.

Please help. In one Answers post:
http://answers.splunk.com/answers/113708/performance-monitoring-not-working-on-windows-app.html

I read that we should have stanza names to have Windows__ prefix. But I don't think its mandatory to have stanza names like that.

Example stanza NOT working:
[perfmon://System]
counters = *
instances = *
interval = 120
object = System
disabled = 0

[perfmon://Process]
counters = *
instances = *
interval = 120
object = Processor
disabled = 0

Example stanza working:
[perfmon://WinSystem]
counters = *
instances = *
interval = 120
object = System
disabled = 0

[perfmon://WinProcess]
counters = *
instances = *
interval = 120
object = Processor
disabled = 0

0 Karma

ansif
Motivator

Try to access Windows performance monitor and check the names of the counter.Might be Windows 2008 has different counter names.

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...