Getting Data In

How do I debug perfmon:memory missing on a windows 2012 R2 host?

cpetterborg
SplunkTrust
SplunkTrust

I have a couple of hosts that have the same version of Windows (2012 R2) that one will produce perfmon:memory data, and the other will not. They have been installed with the same version of the UF (6.5.0) and they are getting the same Splunk_TA_windows app from the deployment server. There is no real difference in the data in the _internal index for these hosts. So I'm thinking that the problem lies in the host itself. How do I debug what the TA is doing for the data to go to be indexed?

0 Karma

tkomatsubara_sp
Splunk Employee
Splunk Employee
0 Karma

alemarzu
Motivator

Hi there @cpetterborg

  • Under which user is Splunk UF running ? Domain or local ? I believe it has to be domain user for remote performance monitoring.
  • Are you forwarding any other type of data besides perfmon from that host ?
0 Karma

cpetterborg
SplunkTrust
SplunkTrust

All the other Perfmon sources work, as well as the Windows events (system, security, application). Only Perfmon:Memory isn't working. I've gone into the machines and run the wql for the Memory data in a Powershell window:

Get-WmiObject -Query "SELECT PagesPerSec, AvailableBytes, CommittedBytes, PercentCommittedBytesInUse FROM Win32_PerfFormattedData_PerfOS_Memory"

and it gives the same results (other than the numbers) on the host that works and the one that doesn't work. The Splunk UF is running as administrator on the hosts.

0 Karma
Get Updates on the Splunk Community!

Unlock New Opportunities with Splunk Education: Explore Our Latest Courses!

At Splunk Education, we’re dedicated to providing top-tier learning experiences that cater to every skill ...

Technical Workshop Series: Splunk Data Management and SPL2 | Register here!

Hey, Splunk Community! Ready to take your data management skills to the next level? Join us for a 3-part ...

Spotting Financial Fraud in the Haystack: A Guide to Behavioral Analytics with Splunk

In today's digital financial ecosystem, security teams face an unprecedented challenge. The sheer volume of ...