I have a WMI Perf counter query that always returns zero in Splunk as the values are always < 1 second. It looks like the values get rounded off in Splunk.
Example WMI.conf:
[WMI:LocalPhysicalDisk]
disabled = 0
server = localhost
wql = SELECT AvgDisksecPerTransfer FROM Win32_PerfFormattedData_PerfDisk_PhysicalDisk
How do I get Splunk to recognize WMI Perf counter values that are in ms (< 1 second)?
Splunk does not actually round off any values. It returns the values as they come from the CIM. In the particular example, "AvgDisksecPerTransfer" is a uint32 type, and that one does not contain fractions. See http://msdn.microsoft.com/en-us/library/aa394262%28VS.85%29.aspx for the definition of the "Win32_PerfFormattedData_PerfDisk_PhysicalDisk" class.