I'm testing Splunk with the Template for Citrix XenApp. It works quite well after changing the powershell scripts and the inputs.conf.
In inputs.conf, I've translated the perfmon counter to german and changed the xml to match the new settings (i.e. Prozessorzeit_(%) - % Processor Time).
This worked for me, but unfortunately all counters with german umlauts (Logischer Datenträger vs. LogicalDisk or Prozessor-Warteschlangenlänge vs. Processor Queue Length) are ignored and sending no data to my indexer.
Is there any workaround for this behaviour?
BTW. I've tried to upgrade my installation to 6.2 but this didn't work because I'm getting the Error "Splunk Enterprise setup wizard ended prematurely" and my Splunk services are gone...
So actually I'm running 6.1.5 on my indexer and my forwarders.
Thanks in advance,
perfmon für german
Translation data are in this register key to find
X= depend how much language you install on this machine.
[perfmon://Available Memory] interval = 30 object = Arbeitsspeicher counters = Verfügbare Bytes; Seiten/s instances = _Total disabled = 0 [perfmon://CPU Load] counters = Prozessorzeit (%);Benutzerzeit (%) instances = _Total interval = 10 object = Prozessor useEnglishOnly = false [perfmon://Free Disk Space] counters = Verfügbare MB;Freier Speicherplatz (%) instances = * interval = 3600 object = Logischer Datenträger useEnglishOnly = false [perfmon://Network Interface] counters = Empfangene Bytes/s;Übertragene Bytes/s instances = * interval = 10 object = Netzwerkschnittstelle useEnglishOnly = false
Upgrade your forwarder to 6.2. (I saw the note that the wizard ended prematurely - you need to solve that!) then use the useEnglishOnly parameter as described here: http://blogs.splunk.com/2014/11/10/splunk-6-2-feature-overview-perfmon-delocalization/
Your alternative is not very pretty, but is described in this blog post: http://blogs.splunk.com/2013/06/17/windows-perfmon-and-internationalization/
I'm going to use your second opinion - and exactly that's my problem.
This is one translation in my input.conf:
[perfmon://Memory] interval = 30 object = Arbeitsspeicher counters = Verfügbare Bytes; Seiten/s instances = * index=xd_perfmon disabled = 0 mode = multikv
The name of the counters I would like to monitor are (in english) Available Bytes; Pages/sec. In german it's called Verfügbare Bytes; Seiten/s. I'm getting data from "Seiten/s", because there's no umlaut, but i don't get data for "Verfügbare Bytes" because there is an umlaut and the SplunkForwarder seems to ignore this counter.
And I can't update my Splunk to 6.2 because of an error with installtion on german windows (sic!) as discussed here: http://answers.splunk.com/answers/177866/why-am-i-getting-splunk-enterprise-setup-wizard-en.html
Looks like I'm stucked until a newer version of Splunk gets released...
how do you solve to get all the missing data into Splunk with a German XenApp 6.5 German OS?
It seems that not every Perfmon Counter (ICA especially) works with the useEnglishOnly = true parameter.
Would it be possible for you to share the input.conf and the xml files?