Splunk App for Windows Infrastructure: Why is page_printed always 0 monitoring Windows print server?

[barrycuda72]

I have followed this example to the letter. http://blogs.splunk.com/2014/04/21/windows-print-monitoring-in-splunk-6/
I am trying to use this to perform chargeback to departments. Everything seems to work with the exception that page_printed is always 0
Hard to do a chargeback when you can't see the total pages printed

[fdarrigo]

Hi. Do you know if this issue has been fixed? I configured my Windows 2008 R2 print server and I am receiving print events, however the page count metrics are wrong:
operation=add
type=PrintJob
printer="AMHMEMGeneralBW2"
machine="00ABMXV00402T1W"
user="fdarrigo"
document="Microsoft Word - Document1"
notify_name="fdarrigo"
JobId=58
data_type="RAW"
print_processor="hpcpp170"
parameters=
driver_name="HP Universal Printing PCL 5 (v5.9.0)"
status="spooling"
priority=1
total_pages=1
size_bytes=0
submitted_time="12/05/2016 15:09:16.951"
page_printed=0

This was for a 2 page Word document.

[ahall_splunk]

The field comes directly from the Printing API in use, so it's generated by Windows. On my Windows Server 2012 R2 print server, it's always filled in. However, your best bet is to look at the actual data - it may be that total_pages is the field you want. I'll do some tests next week and update the blog post if necessary.

[thomasandersen]

I have the same problem. The field total_pages, size_bytes, page_printed is all 0.

[DimkoBilanko]

I have same problem.

I use:

• Windows Server 2012R2 Splunk
• Enterprise 6.4.4 Splunk
• UniversalForwarder 6.4.4

Part of input.conf:

Print monitoring

[WinPrintMon://jobs]
type=job
interval=60
baseline=0
disabled=0

[WinPrintMon://printer]
type = printer
interval = 600
baseline = 1
disabled = 0
index = windows

[WinPrintMon://driver]
type = driver
interval = 600
baseline = 1
disabled = 0
index = windows

[WinPrintMon://port]
type = port
interval = 600
baseline = 1
disabled = 0
index = windows

[infrastructure_]

Same problem here with Server 2008 and 2012R2.
Universal Forwarder 7.0.0