Archive

Perfmon stanza

becksyboy
Communicator

Hi,

we are trying to on board some windows perfmon counters. We can do LogicalDisk, Memory, Network Interface, PhysicalDisk, Process, Processor information, Processor, server.

However we cannot pick up the following. I asked our windows admin to confirm they exist on the servers. I can't find any correct stanza definitions for each type, but below is what we are currently using (for the ones not working)

APP_POOL_WAS

[perfmon://APP_POOL_WAS]
counters = *
instances = *
disabled = 0
interval = 30
mode = multikv
object = *
useEnglishOnly=true
index = windows_perfmon

ASP.NET Applications

[perfmon://ASP.NET_Applications]
counters = *
instances = *
disabled = 0
interval = 30
mode = multikv
object = *
useEnglishOnly=true
index = windows_perfmon

ASP.NET

[perfmon://ASP.NET]
counters = *
instances = *
disabled = 0
interval = 30
mode = multikv
object = *
useEnglishOnly=true
index = windows_perfmon

Cache

[perfmon://Cache]
counters = *
instances = *
disabled = 0
interval = 30
mode = multikv
object = *
useEnglishOnly=true
index = windows_perfmon

HTTP Service Request Queues

[perfmon://HTTP_Service_Request_Queues]
counters = *
instances = *
disabled = 0
interval = 30
mode = multikv
object = *
useEnglishOnly=true
index = windows_perfmon

Paging File

[perfmon://Paging_File]
counters = *
instances = *
disabled = 0
interval = 30
mode = multikv
object = *
useEnglishOnly=true
index = windows_perfmon

W3SVC_W3WP

[perfmon://W3SVC_W3WP]
counters = *
instances = *
disabled = 0
interval = 30
mode = multikv
object = *
useEnglishOnly=true
index = windows_perfmon

WAS_W3WP

[perfmon://WAS_W3WP]
counters = *
instances = *
disabled = 0
interval = 30
mode = multikv
object = *
useEnglishOnly=true
index = windows_perfmon

Web Service

[perfmon://Web_Service]
counters = *
instances = _Total
disabled = 0
interval = 30
mode = multikv
object = *
useEnglishOnly=true
index = windows_perfmon

Tags (1)
0 Karma

adonio
SplunkTrust
SplunkTrust

You can find all of them if you have a full Splunk instance installed on a windows server
navigate to "Settings" (top right) -> click: "Data Inputs" -> click "Local Performance Monitoring" -> click: "New Local Performance -Monitoring" -> use the drop down to pick up the relevant object -> add counters -> add instances -> select and continue with the wizard.
see attached screen shot:
alt text

here is teh stanza for the WEB perfmon data:

  [perfmon://WEB]
    counters = xxxxxx
    index = perfmon
    instances = Default Web Site;_Total
    interval = 30
    object = Web Service
    disabled = 1

note, there were too many counters that i enabled to put in this box
here is a screen shot of the web perfmon data:

alt text

hope it helps

0 Karma

becksyboy
Communicator

copy/paste missed off the wild cards after =

counters = *
instances = *
object = *

0 Karma
.conf21 CFS Extended through 5/20!

Don't miss your chance
to share your Splunk
wisdom in-person or
virtually at .conf21!

Call for Speakers has
been extended through
Thursday, 5/20!