I've configured inputs.conf like below, but I can't see any data. (Other stanzas for [perfmon:// are all working perfectly.)
Splunk Version: Splunk Enterprise 6.2.1
Target Server: Windows 2008 R2 (I can see the Perfmon object and counters from perfmon.exe screen.)
I've double checked all strings to determine if the case sensitive problems.
[perfmon://RPC_HTTP_Proxy] index=perfmon object=RPC/HTTP Proxy counters=\RPC/HTTP Requests per Second; Current Number of Unique Users; Number of Failed Back-End Connection Attempts per Second interval=10 disabled=false showZeroValue=true useEnglishOnly=true
Please help me how to index above Perfmon counters properly.
Hello, i've the same problem with another custom perform.
My indexer don't have this perfmon. the counter of my custom perform is located on 2 servers using splunkforwarder.
any suggestions ?
Can you please check the system from where performance counters are being forwarded? Using start > run > perfmon, whether RPC_HTTP_PROXY is available counter on the machine or not.
If it is, and you have a non prod system with similar configuration see if you can install Splunk and use Add Data > Local Performance Monitor and check whether the same performance counter is listed in splunk or not.
You can also try keeping only above performance counter forwarding in inputs.conf and restart splunk. Validate the splunkd logs for above performance counter, whether there is any error logged or not.
i've found the solution thanks to wildcard in object.
Example inputs.conf :
## S4B Inbound Calls [perfmon://S4BInbountCalls] counters = - Current object = LS:MediationServer.*Inbound Calls instances = _Total interval = 30 index = perfmon disabled = 0 showZeroValue = 1