How do I debug perfmon:memory missing on a windows 2012 R2 host?

[cpetterborg]

I have a couple of hosts that have the same version of Windows (2012 R2) that one will produce perfmon:memory data, and the other will not. They have been installed with the same version of the UF (6.5.0) and they are getting the same Splunk_TA_windows app from the deployment server. There is no real difference in the data in the _internal index for these hosts. So I'm thinking that the problem lies in the host itself. How do I debug what the TA is doing for the data to go to be indexed?

[tkomatsubara_sp]

I didn't try this. But it's worth while to try.
http://superuser.com/questions/453886/perfmon-counters-missing

"lodctr /r (in your command line)"
http://social.technet.microsoft.com/wiki/contents/articles/19374.windows-performance-monitor-unable-...

[alemarzu]

Hi there @cpetterborg

• Under which user is Splunk UF running ? Domain or local ? I believe it has to be domain user for remote performance monitoring.
• Are you forwarding any other type of data besides perfmon from that host ?

[cpetterborg]

All the other Perfmon sources work, as well as the Windows events (system, security, application). Only Perfmon:Memory isn't working. I've gone into the machines and run the wql for the Memory data in a Powershell window:

Get-WmiObject -Query "SELECT PagesPerSec, AvailableBytes, CommittedBytes, PercentCommittedBytesInUse FROM Win32_PerfFormattedData_PerfOS_Memory"

and it gives the same results (other than the numbers) on the host that works and the one that doesn't work. The Splunk UF is running as administrator on the hosts.