Getting Data In
Highlighted

Direction on how to troubleshoot this perfmon issue?

Builder

All,

I have the stock SplunkTAWindows 6.0.0 installed 6.0.0 with default inputs.conf enabled. Since pushing it out I am seeing the following errors.

08-14-2019 17:28:46.460 +0000 ERROR ExecProcessor - message from ""c:\Program Files\SplunkUniversalForwarder\bin\splunk-perfmon.exe"" splunk-perfmon - OutputHandler::composeOutput: Counter is not found: IO Data Bytes/sec

OS is Windows 2016

#inputs.conf 
...
## Process
[perfmon://Process]
counters = % Processor Time; % User Time; % Privileged Time; Virtual Bytes Peak; Virtual Bytes; Page Faults/sec; Working Set Peak; Working Set; Page File Bytes Peak; Page File Bytes; Private Bytes; Thread Count; Priority Base; Elapsed Time; ID Process; Creating Process ID; Pool Paged Bytes; Pool Nonpaged Bytes; Handle Count; IO Read Operations/sec; IO Write Operations/sec; IO Data Operations/sec; IO Other Operations/sec; IO Read Bytes/sec; IO Write Bytes/sec; IO Data Bytes/sec; IO Other Bytes/sec; Working Set - Private
disabled = 0
instances = *
interval = 10
  mode = single
object = Process
useEnglishOnly=true
  index=winmetrics

Any idea on what might the issue be? Where I can start troubleshooting?

Highlighted

Re: Direction on how to troubleshoot this perfmon issue?

Path Finder

You can put the inputs.conf here?

0 Karma
Highlighted

Re: Direction on how to troubleshoot this perfmon issue?

Path Finder

You can put the inputs.conf here?

0 Karma
Highlighted

Re: Direction on how to troubleshoot this perfmon issue?

Contributor

This means, "IO Data Bytes" counter is not found on target host's perfmon logs. Simply remove "IO Data Bytes/sec;" from
inputs.conf for that host, and restart forwarder.

0 Karma
Speak Up for Splunk Careers!

We want to better understand the impact Splunk experience and expertise has has on individuals' careers, and help highlight the growing demand for Splunk skills.