https://community.splunk.com/t5/Getting-Data-In/Unable-to-pull-Perfmon-Counter-for-Processor-Time-Windows-2003/m-p/47430#M9001 <P>Are you sure the Processor Information perfmon object exists in Windows 2003? I thought that was a new one....</P> Sun, 24 Jul 2011 14:23:58 GMT neilamoran 2011-07-24T14:23:58Z https://community.splunk.com/t5/Getting-Data-In/Unable-to-pull-Perfmon-Counter-for-Processor-Time-Windows-2003/m-p/47429#M9000 <P>Has anyone seen the errors below and know how to correct? This same perfmon.conf is applied to both Windows 2008 64-bit (working) and Windows 2003 32-bit (% Processor Time not working). The other counters are working just fine on both Windows 2008 and 2003. Running Splunk 4.2.2.</P> <PRE><CODE>**ERRORS in splunkd.log**: 07-22-2011 15:06:47.510 -0400 ERROR ExecProcessor - message from ""C:\Program Files\SplunkUniversalForwarder\bin\splunk-perfmon.exe" -noui" splunk-perfmon - Unable to add counter '\Processor Information(*)\% Processor Time' error 0xc0000bb8 07-22-2011 16:30:14.057 -0400 ERROR ExecProcessor - message from ""C:\Program Files\SplunkUniversalForwarder\bin\splunk-perfmon.exe" -noui" splunk-perfmon - Counter list is empty in method PeriodicDataCollector::tick **perfmon.conf** [Perfmon:LocalPhysicalDisk] interval = 60 object = PhysicalDisk counters = % Disk Read Time; % Disk Write Time; % Disk Time; Current Disk Queue Length instances = _Total disabled = 0 index = ems [Perfmon:LocalMainMemory] interval = 60 object = Memory counters = % Committed Bytes In Use disabled = 0 index = ems [Perfmon:Processor] interval = 60 object = Processor Information counters = % Processor Time instances = _Total disabled = 0 index = ems </CODE></PRE> Fri, 22 Jul 2011 20:52:15 GMT https://community.splunk.com/t5/Getting-Data-In/Unable-to-pull-Perfmon-Counter-for-Processor-Time-Windows-2003/m-p/47429#M9000 larry_lind 2011-07-22T20:52:15Z https://community.splunk.com/t5/Getting-Data-In/Unable-to-pull-Perfmon-Counter-for-Processor-Time-Windows-2003/m-p/47430#M9001 <P>Are you sure the Processor Information perfmon object exists in Windows 2003? I thought that was a new one....</P> Sun, 24 Jul 2011 14:23:58 GMT https://community.splunk.com/t5/Getting-Data-In/Unable-to-pull-Perfmon-Counter-for-Processor-Time-Windows-2003/m-p/47430#M9001 neilamoran 2011-07-24T14:23:58Z https://community.splunk.com/t5/Getting-Data-In/Unable-to-pull-Perfmon-Counter-for-Processor-Time-Windows-2003/m-p/47431#M9002 <P>I found the issue. It was the Perfmon Counter Object that changed between 2003 and 2008.</P> <P>Windows 2003:<BR /><BR /> Object = Process</P> <P>Windows 2008:<BR /><BR /> Object = Process Information</P> <P>All is working now. </P> Mon, 25 Jul 2011 13:41:44 GMT https://community.splunk.com/t5/Getting-Data-In/Unable-to-pull-Perfmon-Counter-for-Processor-Time-Windows-2003/m-p/47431#M9002 larry_lind 2011-07-25T13:41:44Z https://community.splunk.com/t5/Getting-Data-In/Unable-to-pull-Perfmon-Counter-for-Processor-Time-Windows-2003/m-p/47432#M9003 <P>I'm curious - I'm also seeing lots of the "Counter list is empty" error message, and also having a problem with collecting % Processor Time for the _Total instance - all my instances are returned regardless of which ones I specify in perfmon.conf.</P> <P>I am also running UF 4.2.2 on 64bit Windows 2003 R2 and 4.2.2 on the Indexer (Windows 2008 R2). Have also posted this question - <A href="http://splunk-base.splunk.com/answers/27989/specific-perfmon-instance-collection-problem">http://splunk-base.splunk.com/answers/27989/specific-perfmon-instance-collection-problem</A>.</P> <P>Have you seen similar behaviour in your installation? Or are you just getting the _Total instance as expected?</P> Tue, 16 Aug 2011 08:17:55 GMT https://community.splunk.com/t5/Getting-Data-In/Unable-to-pull-Perfmon-Counter-for-Processor-Time-Windows-2003/m-p/47432#M9003 neilamoran 2011-08-16T08:17:55Z