splunk-perfmon.exe won't start

rsantoso_splunk — Mon, 17 Jun 2019 04:31:08 GMT

The splunk-perfmon.exe process exits soon after start with no error being logged wither in the splunkd.log or in the windows event log.

There is error message in the event viewer:
Perflib 1008 error
(perfmon doesn’t open)

Re: splunk-perfmon.exe won't start

rsantoso_splunk — Mon, 17 Jun 2019 04:32:49 GMT

1) Open a CMD via run as admin

2) Rebuild performance counters, run commands:

C:\Windows\system32\lodctr.exe /R
C:\Windows\SysWOW64\lodctr.exe /R

3) Now re-register the computer´s performance libraries with the following:

C:\Windows\System32\wbem\winmgmt.exe /RESYNCPERF
C:\Windows\SysWOW64\wbem\winmgmt.exe /RESYNCPERF

After perform this, the repair the perfmon metrics are now coming in.

Reference:
https://www.admin-enclave.com/en/articles/windows/306-resolved-the-open-procedure-for-service-bits-in-dll-c-windows-system32-bitsperf-dll-failed-performance-data-for-this-service-will-not-be-available-the-first-four-bytes-dword-of-the-data-section-contains-the-error-code.html