Getting Data In
Highlighted

How do I debug perfmon:memory missing on a windows 2012 R2 host?

SplunkTrust
SplunkTrust

I have a couple of hosts that have the same version of Windows (2012 R2) that one will produce perfmon:memory data, and the other will not. They have been installed with the same version of the UF (6.5.0) and they are getting the same SplunkTAwindows app from the deployment server. There is no real difference in the data in the _internal index for these hosts. So I'm thinking that the problem lies in the host itself. How do I debug what the TA is doing for the data to go to be indexed?

0 Karma
Highlighted

Re: How do I debug perfmon:memory missing on a windows 2012 R2 host?

Motivator

Hi there @cpetterborg

  • Under which user is Splunk UF running ? Domain or local ? I believe it has to be domain user for remote performance monitoring.
  • Are you forwarding any other type of data besides perfmon from that host ?
0 Karma
Highlighted

Re: How do I debug perfmon:memory missing on a windows 2012 R2 host?

SplunkTrust
SplunkTrust

All the other Perfmon sources work, as well as the Windows events (system, security, application). Only Perfmon:Memory isn't working. I've gone into the machines and run the wql for the Memory data in a Powershell window:

Get-WmiObject -Query "SELECT PagesPerSec, AvailableBytes, CommittedBytes, PercentCommittedBytesInUse FROM Win32_PerfFormattedData_PerfOS_Memory"

and it gives the same results (other than the numbers) on the host that works and the one that doesn't work. The Splunk UF is running as administrator on the hosts.

0 Karma
Highlighted

Re: How do I debug perfmon:memory missing on a windows 2012 R2 host?

Splunk Employee
Splunk Employee
0 Karma