Getting Data In
Highlighted

How to get WMI Perf counters that are in ms

New Member

I have a WMI Perf counter query that always returns zero in Splunk as the values are always < 1 second. It looks like the values get rounded off in Splunk.

Example WMI.conf:

[WMI:LocalPhysicalDisk]

disabled = 0

server = localhost

wql = SELECT AvgDisksecPerTransfer FROM Win32_PerfFormattedData_PerfDisk_PhysicalDisk

How do I get Splunk to recognize WMI Perf counter values that are in ms (< 1 second)?

Tags (1)
0 Karma
Highlighted

Re: How to get WMI Perf counters that are in ms

Splunk Employee
Splunk Employee

Splunk does not actually round off any values. It returns the values as they come from the CIM. In the particular example, "AvgDisksecPerTransfer" is a uint32 type, and that one does not contain fractions. See http://msdn.microsoft.com/en-us/library/aa394262%28VS.85%29.aspx for the definition of the "Win32_PerfFormattedData_PerfDisk_PhysicalDisk" class.