Getting Data In

Direction on how to troubleshoot this perfmon issue?

daniel333
Builder

All,

I have the stock Splunk_TA_Windows 6.0.0 installed 6.0.0 with default inputs.conf enabled. Since pushing it out I am seeing the following errors.

08-14-2019 17:28:46.460 +0000 ERROR ExecProcessor - message from ""c:\Program Files\SplunkUniversalForwarder\bin\splunk-perfmon.exe"" splunk-perfmon - OutputHandler::composeOutput: Counter is not found: IO Data Bytes/sec

OS is Windows 2016

#inputs.conf 
...
## Process
[perfmon://Process]
counters = % Processor Time; % User Time; % Privileged Time; Virtual Bytes Peak; Virtual Bytes; Page Faults/sec; Working Set Peak; Working Set; Page File Bytes Peak; Page File Bytes; Private Bytes; Thread Count; Priority Base; Elapsed Time; ID Process; Creating Process ID; Pool Paged Bytes; Pool Nonpaged Bytes; Handle Count; IO Read Operations/sec; IO Write Operations/sec; IO Data Operations/sec; IO Other Operations/sec; IO Read Bytes/sec; IO Write Bytes/sec; IO Data Bytes/sec; IO Other Bytes/sec; Working Set - Private
disabled = 0
instances = *
interval = 10
  mode = single
object = Process
useEnglishOnly=true
  index=winmetrics

Any idea on what might the issue be? Where I can start troubleshooting?

akocak
Contributor

This means, "IO Data Bytes" counter is not found on target host's perfmon logs. Simply remove "IO Data Bytes/sec;" from
inputs.conf for that host, and restart forwarder.

0 Karma

Kawtar
Path Finder

You can put the inputs.conf here?

0 Karma

Kawtar
Path Finder

You can put the inputs.conf here?

0 Karma
Get Updates on the Splunk Community!

.conf24 | Day 0

Hello Splunk Community! My name is Chris, and I'm based in Canberra, Australia's capital, and I travelled for ...

Enhance Security Visibility with Splunk Enterprise Security 7.1 through Threat ...

(view in My Videos)Struggling with alert fatigue, lack of context, and prioritization around security ...

Troubleshooting the OpenTelemetry Collector

  In this tech talk, you’ll learn how to troubleshoot the OpenTelemetry collector - from checking the ...