topic Re: Perfmon and zero value data in Getting Data In

Perfmon and zero value data

Derek — Wed, 12 Oct 2011 11:55:59 GMT

Hi,

Does the Perfmon inputs record data when the value is zero?

It would seem that it doesn't and that differs from WMI inputs.

Example Perfmon Stanza:

[PERFMON:System] counters = Processor Queue Length disabled = 0 instances = interval = 5 object = System index = main

Thanks.

Re: Perfmon and zero value data

_d_ — Wed, 12 Oct 2011 15:33:46 GMT

Hi Derek, I am not sure whether perfmon will record value=0 data - although i would suspect that it does - but if you want to make sure fire up perfmon in your Windows machine, add those instances and see what the graph says.

Re: Perfmon and zero value data

Derek — Wed, 12 Oct 2011 15:48:09 GMT

When I load up perfmon, it shows the current value of 0 for some of the counters when they are zero and yet nothing in Splunk.

Re: Perfmon and zero value data

_d_ — Wed, 12 Oct 2011 15:54:04 GMT

..and I am assuming that the perfmon stanzas are enabled (ie. disabled=false), correct?
Do you see other non-zero values?

Re: Perfmon and zero value data

Derek — Wed, 12 Oct 2011 15:57:29 GMT

Yes. I see other non-zero data. Posted a sample stanza above.

Re: Perfmon and zero value data

_d_ — Wed, 12 Oct 2011 16:04:05 GMT

I see that your "instances =" is empty. Which instance of that Object are you interested in? Try instances=*

Re: Perfmon and zero value data

Derek — Wed, 12 Oct 2011 16:46:22 GMT

For that particluar counter there are no instances. So since I'm getting entries when the value is not zero, I assume it's ignoring it...

Re: Perfmon and zero value data

Derek — Tue, 18 Oct 2011 11:32:31 GMT

I Contacted Support and they don't believe this is correct and have opened an issue with engineering

Re: Perfmon and zero value data

vdubgeek — Mon, 25 Jun 2012 16:38:46 GMT

Were you able to determine if this is correct or not? I'm seeing the same issue here with perf counters that return a value of 0.

Re: Perfmon and zero value data

vcarbona — Mon, 28 Sep 2020 13:00:07 GMT

I've been able to debug this using $SPLUNK_HOME\bin\splunk-perfmon.exe -showzero
You must first set your SPLUNK_HOME environment variable before executing the above command.
A GUI will popup and you simply select which counter you suspect is not working. Within 10 seconds you start seeing the counter values (CTRL-C to break out of it). If you omit the -showzero parameter and use that same counter nothing will print to the screen and you'll have your answer.

I noticed that the scripted input (in inputs.conf) shows it uses the $SPLUNK_HOME\bin\scripts\splunk_perfmon.path. I guess zero (0) values are suppressed because it saves disk. If you absolutely want those to NOT be suppressed, just update the splunk-perfmon.path file and add the -showzero parameter to it and restart. ie:

$SPLUNK_HOME\bin\splunk-perfmon.exe -noui -showzero

One more thing: When I say zero (0) values are suppressed, I mean absolute 0 NOT 0.125673 . The latter will be captured by splunk-perfmon.exe and forwarded out.

Re: Perfmon and zero value data

Derek — Fri, 21 Dec 2012 13:32:02 GMT

Thanks for the followup. I believe they added that flag in a release since I initially fixed it. To be honest I had forgotten about it as we stuck with WMI instead of Perfmon.

Re: Perfmon and zero value data

bravon — Mon, 08 Dec 2014 12:09:54 GMT

showZeroValue = 1

http://blogs.splunk.com/2013/10/28/new-features-for-perfmon-in-splunk-6/