When I open Windows Management the System Management panel shows buttons for Events, Errors and Warnings. These are all prefixed with N/A but I presume this should be a value. If I click on these buttons I can see the events so it looks like the count is not working.
I am currently on Splunk 4.3.1 build 119532 and the Windows app is 4.5.1 but I think it has always been this way.
Performance Snapshot is also showing "No results found." and when I click on the inspect link it shows:
This search has completed, but did not match any events. The terms specified in the highlighted portion of the search:
search index="summary" source="performance_snapshot" | timechart avg(PercentProcessorTime) as "CPU",avg(PercentCommittedBytesInUse) as "Memory",avg(PercentDiskTime) as "Disk"
over the time range:
27/03/2012 07:51:19.000 – 27/03/2012 08:51:19.000
did not return any data. Possible solutions are to:
relax the primary search criteria
widen the time range of the search
check that the default search indexes for your account include the desired indexes
The following messages were returned by the search subsystem:
DEBUG: base lispy: [ AND index::summary source::performance_snapshot ]
DEBUG: search context: user="admin", app="windows", bs-pathname="C:\Program Files\Splunk\etc"
Learn more about troubleshooting empty search results at Splunk Documentation.
(SID: 1332834679.51)
There is a saved search called 'performance_snapshot' that is scheduled to run every 5 minutes and power the summary index that populates this dashboard.
If you go to Manager > Searches & Reports, is this saved search enabled?
If you click 'View Recent', do you see jobs that had more than 0 results returned?
If you click 'Run', do you get results in the popup window?