we are trying to on board some windows perfmon counters. We can do LogicalDisk, Memory, Network Interface, PhysicalDisk, Process, Processor information, Processor, server.
However we cannot pick up the following. I asked our windows admin to confirm they exist on the servers. I can't find any correct stanza definitions for each type, but below is what we are currently using (for the ones not working)
You can find all of them if you have a full Splunk instance installed on a windows server
navigate to "Settings" (top right) -> click: "Data Inputs" -> click "Local Performance Monitoring" -> click: "New Local Performance -Monitoring" -> use the drop down to pick up the relevant object -> add counters -> add instances -> select and continue with the wizard.
see attached screen shot:
here is teh stanza for the WEB perfmon data:
counters = xxxxxx
index = perfmon
instances = Default Web Site;_Total
interval = 30
object = Web Service
disabled = 1
note, there were too many counters that i enabled to put in this box
here is a screen shot of the web perfmon data: