All Apps and Add-ons

Perfmon and german umlaute

RainerKnufinke
New Member

Hi Folks,

I'm testing Splunk with the Template for Citrix XenApp. It works quite well after changing the powershell scripts and the inputs.conf.
In inputs.conf, I've translated the perfmon counter to german and changed the xml to match the new settings (i.e. Prozessorzeit_(%) - % Processor Time).

This worked for me, but unfortunately all counters with german umlauts (Logischer Datenträger vs. LogicalDisk or Prozessor-Warteschlangenlänge vs. Processor Queue Length) are ignored and sending no data to my indexer.

Is there any workaround for this behaviour?

BTW. I've tried to upgrade my installation to 6.2 but this didn't work because I'm getting the Error "Splunk Enterprise setup wizard ended prematurely" and my Splunk services are gone...

So actually I'm running 6.1.5 on my indexer and my forwarders.

Thanks in advance,
Rainer

0 Karma

karakutu
Path Finder

perfmon für german

Translation data are in this register key to find

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Perflib\00[X]

X= depend how much language you install on this machine.

[perfmon://Available Memory]
interval = 30
object = Arbeitsspeicher
counters =  Verfügbare Bytes; Seiten/s
instances = _Total
disabled = 0

[perfmon://CPU Load]
counters = Prozessorzeit (%);Benutzerzeit (%)
instances = _Total
interval = 10
object = Prozessor
useEnglishOnly = false

[perfmon://Free Disk Space]
counters = Verfügbare MB;Freier Speicherplatz (%)
instances = *
interval = 3600
object = Logischer Datenträger
useEnglishOnly = false

[perfmon://Network Interface]
counters = Empfangene Bytes/s;Übertragene Bytes/s
instances = *
interval = 10
object = Netzwerkschnittstelle
useEnglishOnly = false
0 Karma

ahall_splunk
Splunk Employee
Splunk Employee

Upgrade your forwarder to 6.2. (I saw the note that the wizard ended prematurely - you need to solve that!) then use the useEnglishOnly parameter as described here: http://blogs.splunk.com/2014/11/10/splunk-6-2-feature-overview-perfmon-delocalization/

Your alternative is not very pretty, but is described in this blog post: http://blogs.splunk.com/2013/06/17/windows-perfmon-and-internationalization/

0 Karma

RainerKnufinke
New Member

Hallo Christian,

I've never solved this problem because we don't use Splunk for now.

Gruß,
Rainer

0 Karma

RainerKnufinke
New Member

I'm going to use your second opinion - and exactly that's my problem.
This is one translation in my input.conf:

[perfmon://Memory]
interval = 30
object = Arbeitsspeicher
counters =  Verfügbare Bytes; Seiten/s
instances = *
index=xd_perfmon
disabled = 0
mode = multikv

The name of the counters I would like to monitor are (in english) Available Bytes; Pages/sec. In german it's called Verfügbare Bytes; Seiten/s. I'm getting data from "Seiten/s", because there's no umlaut, but i don't get data for "Verfügbare Bytes" because there is an umlaut and the SplunkForwarder seems to ignore this counter.

And I can't update my Splunk to 6.2 because of an error with installtion on german windows (sic!) as discussed here: http://answers.splunk.com/answers/177866/why-am-i-getting-splunk-enterprise-setup-wizard-en.html

Looks like I'm stucked until a newer version of Splunk gets released...

Thanks,

Rainer.

0 Karma

christianpanizi
New Member

Hello Rainer,

how do you solve to get all the missing data into Splunk with a German XenApp 6.5 German OS?

It seems that not every Perfmon Counter (ICA especially) works with the useEnglishOnly = true parameter.

Would it be possible for you to share the input.conf and the xml files?

Beste Grüße
Christian

0 Karma
Get Updates on the Splunk Community!

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...