https://community.splunk.com/t5/Getting-Data-In/How-do-I-debug-perfmon-memory-missing-on-a-windows-2012-R2-host/m-p/278921#M53385 <P>All the other Perfmon sources work, as well as the Windows events (system, security, application). Only Perfmon:Memory isn't working. I've gone into the machines and run the wql for the Memory data in a Powershell window:</P> <PRE><CODE>Get-WmiObject -Query "SELECT PagesPerSec, AvailableBytes, CommittedBytes, PercentCommittedBytesInUse FROM Win32_PerfFormattedData_PerfOS_Memory" </CODE></PRE> <P>and it gives the same results (other than the numbers) on the host that works and the one that doesn't work. The Splunk UF is running as administrator on the hosts.</P> Wed, 14 Dec 2016 18:19:24 GMT cpetterborg 2016-12-14T18:19:24Z https://community.splunk.com/t5/Getting-Data-In/How-do-I-debug-perfmon-memory-missing-on-a-windows-2012-R2-host/m-p/278919#M53383 <P>I have a couple of hosts that have the same version of Windows (2012 R2) that one will produce perfmon:memory data, and the other will not. They have been installed with the same version of the UF (6.5.0) and they are getting the same Splunk_TA_windows app from the deployment server. There is no real difference in the data in the _internal index for these hosts. So I'm thinking that the problem lies in the host itself. <STRONG>How do I debug</STRONG> what the TA is doing for the data to go to be indexed?</P> Tue, 29 Sep 2020 12:07:01 GMT https://community.splunk.com/t5/Getting-Data-In/How-do-I-debug-perfmon-memory-missing-on-a-windows-2012-R2-host/m-p/278919#M53383 cpetterborg 2020-09-29T12:07:01Z https://community.splunk.com/t5/Getting-Data-In/How-do-I-debug-perfmon-memory-missing-on-a-windows-2012-R2-host/m-p/278920#M53384 <P>Hi there @cpetterborg</P> <UL> <LI>Under which user is Splunk UF running ? Domain or local ? I believe it has to be domain user for remote performance monitoring.</LI> <LI>Are you forwarding any other type of data besides perfmon from that host ?</LI> </UL> Wed, 14 Dec 2016 17:57:14 GMT https://community.splunk.com/t5/Getting-Data-In/How-do-I-debug-perfmon-memory-missing-on-a-windows-2012-R2-host/m-p/278920#M53384 alemarzu 2016-12-14T17:57:14Z https://community.splunk.com/t5/Getting-Data-In/How-do-I-debug-perfmon-memory-missing-on-a-windows-2012-R2-host/m-p/278921#M53385 <P>All the other Perfmon sources work, as well as the Windows events (system, security, application). Only Perfmon:Memory isn't working. I've gone into the machines and run the wql for the Memory data in a Powershell window:</P> <PRE><CODE>Get-WmiObject -Query "SELECT PagesPerSec, AvailableBytes, CommittedBytes, PercentCommittedBytesInUse FROM Win32_PerfFormattedData_PerfOS_Memory" </CODE></PRE> <P>and it gives the same results (other than the numbers) on the host that works and the one that doesn't work. The Splunk UF is running as administrator on the hosts.</P> Wed, 14 Dec 2016 18:19:24 GMT https://community.splunk.com/t5/Getting-Data-In/How-do-I-debug-perfmon-memory-missing-on-a-windows-2012-R2-host/m-p/278921#M53385 cpetterborg 2016-12-14T18:19:24Z https://community.splunk.com/t5/Getting-Data-In/How-do-I-debug-perfmon-memory-missing-on-a-windows-2012-R2-host/m-p/278922#M53386 <P>I didn't try this. But it's worth while to try.<BR /> <A href="http://superuser.com/questions/453886/perfmon-counters-missing">http://superuser.com/questions/453886/perfmon-counters-missing</A></P> <P>"lodctr /r (in your command line)"<BR /> <A href="http://social.technet.microsoft.com/wiki/contents/articles/19374.windows-performance-monitor-unable-to-add-these-counters.aspx">http://social.technet.microsoft.com/wiki/contents/articles/19374.windows-performance-monitor-unable-to-add-these-counters.aspx</A></P> Thu, 15 Dec 2016 14:08:24 GMT https://community.splunk.com/t5/Getting-Data-In/How-do-I-debug-perfmon-memory-missing-on-a-windows-2012-R2-host/m-p/278922#M53386 tkomatsubara_sp 2016-12-15T14:08:24Z