I have a couple of hosts that have the same version of Windows (2012 R2) that one will produce perfmon:memory data, and the other will not. They have been installed with the same version of the UF (6.5.0) and they are getting the same SplunkTAwindows app from the deployment server. There is no real difference in the data in the _internal index for these hosts. So I'm thinking that the problem lies in the host itself. How do I debug what the TA is doing for the data to go to be indexed?
Hi there @cpetterborg
All the other Perfmon sources work, as well as the Windows events (system, security, application). Only Perfmon:Memory isn't working. I've gone into the machines and run the wql for the Memory data in a Powershell window:
Get-WmiObject -Query "SELECT PagesPerSec, AvailableBytes, CommittedBytes, PercentCommittedBytesInUse FROM Win32_PerfFormattedData_PerfOS_Memory"
and it gives the same results (other than the numbers) on the host that works and the one that doesn't work. The Splunk UF is running as administrator on the hosts.
I didn't try this. But it's worth while to try.
"lodctr /r (in your command line)"