Perfmon stanza

becksyboy · ‎04-30-2019

Hi,

we are trying to on board some windows perfmon counters. We can do LogicalDisk, Memory, Network Interface, PhysicalDisk, Process, Processor information, Processor, server.

However we cannot pick up the following. I asked our windows admin to confirm they exist on the servers. I can't find any correct stanza definitions for each type, but below is what we are currently using (for the ones not working)

APP_POOL_WAS

[perfmon://APP_POOL_WAS]
counters = *
instances = *
disabled = 0
interval = 30
mode = multikv
object = *
useEnglishOnly=true
index = windows_perfmon

ASP.NET Applications

[perfmon://ASP.NET_Applications]
counters = *
instances = *
disabled = 0
interval = 30
mode = multikv
object = *
useEnglishOnly=true
index = windows_perfmon

ASP.NET

[perfmon://ASP.NET]
counters = *
instances = *
disabled = 0
interval = 30
mode = multikv
object = *
useEnglishOnly=true
index = windows_perfmon

Cache

[perfmon://Cache]
counters = *
instances = *
disabled = 0
interval = 30
mode = multikv
object = *
useEnglishOnly=true
index = windows_perfmon

HTTP Service Request Queues

[perfmon://HTTP_Service_Request_Queues]
counters = *
instances = *
disabled = 0
interval = 30
mode = multikv
object = *
useEnglishOnly=true
index = windows_perfmon

Paging File

[perfmon://Paging_File]
counters = *
instances = *
disabled = 0
interval = 30
mode = multikv
object = *
useEnglishOnly=true
index = windows_perfmon

W3SVC_W3WP

[perfmon://W3SVC_W3WP]
counters = *
instances = *
disabled = 0
interval = 30
mode = multikv
object = *
useEnglishOnly=true
index = windows_perfmon

WAS_W3WP

[perfmon://WAS_W3WP]
counters = *
instances = *
disabled = 0
interval = 30
mode = multikv
object = *
useEnglishOnly=true
index = windows_perfmon

Web Service

[perfmon://Web_Service]
counters = *
instances = _Total
disabled = 0
interval = 30
mode = multikv
object = *
useEnglishOnly=true
index = windows_perfmon

adonio · ‎05-13-2019

You can find all of them if you have a full Splunk instance installed on a windows server
navigate to "Settings" (top right) -> click: "Data Inputs" -> click "Local Performance Monitoring" -> click: "New Local Performance -Monitoring" -> use the drop down to pick up the relevant object -> add counters -> add instances -> select and continue with the wizard.
see attached screen shot:

here is teh stanza for the WEB perfmon data:

  [perfmon://WEB]
    counters = xxxxxx
    index = perfmon
    instances = Default Web Site;_Total
    interval = 30
    object = Web Service
    disabled = 1

note, there were too many counters that i enabled to put in this box
here is a screen shot of the web perfmon data:

hope it helps

becksyboy · ‎04-30-2019

copy/paste missed off the wild cards after =

counters = *
instances = *
object = *