All Apps and Add-ons

Splunk App for Windows Infrastructure: Why is page_printed always 0 monitoring Windows print server?

Explorer

I have followed this example to the letter. http://blogs.splunk.com/2014/04/21/windows-print-monitoring-in-splunk-6/
I am trying to use this to perform chargeback to departments. Everything seems to work with the exception that page_printed is always 0
Hard to do a chargeback when you can't see the total pages printed

Path Finder

Hi. Do you know if this issue has been fixed? I configured my Windows 2008 R2 print server and I am receiving print events, however the page count metrics are wrong:
operation=add
type=PrintJob
printer="AMHMEMGeneralBW2"
machine="00ABMXV00402T1W"
user="fdarrigo"
document="Microsoft Word - Document1"
notifyname="fdarrigo"
JobId=58
data
type="RAW"
printprocessor="hpcpp170"
parameters=
driver
name="HP Universal Printing PCL 5 (v5.9.0)"
status="spooling"
priority=1
total_pages=1
sizebytes=0
submitted
time="12/05/2016 15:09:16.951"
page_printed=0

This was for a 2 page Word document.

0 Karma

Splunk Employee
Splunk Employee

The field comes directly from the Printing API in use, so it's generated by Windows. On my Windows Server 2012 R2 print server, it's always filled in. However, your best bet is to look at the actual data - it may be that total_pages is the field you want. I'll do some tests next week and update the blog post if necessary.

0 Karma

I have the same problem. The field totalpages, sizebytes, page_printed is all 0.

0 Karma

Explorer

I have same problem.

I use:

  • Windows Server 2012R2 Splunk
  • Enterprise 6.4.4 Splunk
  • UniversalForwarder 6.4.4

Part of input.conf:

Print monitoring

[WinPrintMon://jobs]
type=job
interval=60
baseline=0
disabled=0

[WinPrintMon://printer]
type = printer
interval = 600
baseline = 1
disabled = 0
index = windows

[WinPrintMon://driver]
type = driver
interval = 600
baseline = 1
disabled = 0
index = windows

[WinPrintMon://port]
type = port
interval = 600
baseline = 1
disabled = 0
index = windows

0 Karma

Same problem here with Server 2008 and 2012R2.
Universal Forwarder 7.0.0

0 Karma