Direction on how to troubleshoot this perfmon issue?

[daniel333]

All,

I have the stock Splunk_TA_Windows 6.0.0 installed 6.0.0 with default inputs.conf enabled. Since pushing it out I am seeing the following errors.

08-14-2019 17:28:46.460 +0000 ERROR ExecProcessor - message from ""c:\Program Files\SplunkUniversalForwarder\bin\splunk-perfmon.exe"" splunk-perfmon - OutputHandler::composeOutput: Counter is not found: IO Data Bytes/sec

OS is Windows 2016

#inputs.conf 
...
## Process
[perfmon://Process]
counters = % Processor Time; % User Time; % Privileged Time; Virtual Bytes Peak; Virtual Bytes; Page Faults/sec; Working Set Peak; Working Set; Page File Bytes Peak; Page File Bytes; Private Bytes; Thread Count; Priority Base; Elapsed Time; ID Process; Creating Process ID; Pool Paged Bytes; Pool Nonpaged Bytes; Handle Count; IO Read Operations/sec; IO Write Operations/sec; IO Data Operations/sec; IO Other Operations/sec; IO Read Bytes/sec; IO Write Bytes/sec; IO Data Bytes/sec; IO Other Bytes/sec; Working Set - Private
disabled = 0
instances = *
interval = 10
  mode = single
object = Process
useEnglishOnly=true
  index=winmetrics

Any idea on what might the issue be? Where I can start troubleshooting?

[akocak]

This means, "IO Data Bytes" counter is not found on target host's perfmon logs. Simply remove "IO Data Bytes/sec;" from
inputs.conf for that host, and restart forwarder.

[Kawtar]

You can put the inputs.conf here?

[Kawtar]

You can put the inputs.conf here?