All Apps and Add-ons

Splunk_TA_Windows Performance Monitoring dashboards not working

davidjohnbecket
Path Finder

Is the transforms.conf working correctly for the 'counter' extract in the Splunk_TA_Windows app?

[metric_name_for_perfmon_metrics_store]
REGEX = counter=\"?([^\"\r\n]*[^\"\s])
FORMAT = metric_name::$1
WRITE_META = true

I am having issues getting the Performance Monitoring dashboard working and my investigations are leading me to think that the 'counter' field is not being populated and it is necessary for the drop-down in the dashboards to work...

Testing the regexs via search of the others in the transforms are working fine:

perfmon-index eventtype="perfmon_windows" object=*
| regex object"=\"?([^\"\r\n][^\"\s])"
| regex instance"=\"?([^\"\r\n]
[^\"\s])"
| regex collection"=\"?([^\"\r\n]*[^\"\s])"

| table object, instance, collection, counter

but the counter extract doesnt work:

perfmon-index eventtype="perfmon_windows" object=*
| regex counter"=\"?([^\"\r\n]*[^\"\s])"
| table counter

0 Karma
Get Updates on the Splunk Community!

Introducing Ingest Actions: Filter, Mask, Route, Repeat

WATCH NOW Ingest Actions (IA) is the best new way to easily filter, mask and route your data in Splunk® ...

Splunk Forwarders and Forced Time Based Load Balancing

Splunk customers use universal forwarders to collect and send data to Splunk. A universal forwarder can send ...

NEW! Log Views in Splunk Observability Dashboards Gives Context From a Single Page

Today, Splunk Observability releases log views, a new feature for users to add their logs data from Splunk Log ...