Getting Data In

Collecting data with Perfmon: instances with spaces in truncated when ingested to metrics index

Path Finder

I'm using Splunk to collect the state of Microsoft IIS web server app pools. I've noticed that when the Universal Forwarder collects Perfmon data that has instance names with spaces in, and when ingested into a Metrics index, that the instance name after the first space is lost. But this doesn't happen if I ingested into a normal index.

Here is my configuration in the inputs.conf file:

interval = 10
object = APP_POOL_WAS
counters = Current Application Pool State
instances = *
disabled = 0
index = metrics_index
sourcetype = perfmon:IISAppPoolState

It is on a machine which has IIS pools which have spaces in there names - ie "company website" "company portal" "HR web"

When this data is ingested into the metrics index and accessed via the following Splunk command:

| mstats latest(_value) as IISAppPoolState WHERE index=metrics_index metric_name="IISAppPoolState.Current Application Pool State" by instance, host

I end up with instance values that truncate at the first space. So "company website" becomes just "company" (and who knows what happens to "company portal").

However if I direct the data into a normal index the instance names are wrapped in quotes and the space in the instance name persevered.

Is there anyway to fix this behaviour? Collecting this data into a metrics index has worked fine until now but thanks to this server having IIS site names with spaces in them it's causing a real problem.


Thanks for your thoughts!

Labels (2)
Tags (2)
0 Karma
Get Updates on the Splunk Community!

Enterprise Security Content Update (ESCU) | New Releases

In the last month, the Splunk Threat Research Team (STRT) has had 2 releases of new security content via the ...

Announcing the 1st Round Champion’s Tribute Winners of the Great Resilience Quest

We are happy to announce the 20 lucky questers who are selected to be the first round of Champion's Tribute ...

We’ve Got Education Validation!

Are you feeling it? All the career-boosting benefits of up-skilling with Splunk? It’s not just a feeling, it's ...