How to get WMI Perf counters that are in ms

[COH]

I have a WMI Perf counter query that always returns zero in Splunk as the values are always < 1 second. It looks like the values get rounded off in Splunk.

Example WMI.conf:

[WMI:LocalPhysicalDisk]

disabled = 0

server = localhost

wql = SELECT AvgDisksecPerTransfer FROM Win32_PerfFormattedData_PerfDisk_PhysicalDisk

How do I get Splunk to recognize WMI Perf counter values that are in ms (< 1 second)?

[igor]

Splunk does not actually round off any values. It returns the values as they come from the CIM. In the particular example, "AvgDisksecPerTransfer" is a uint32 type, and that one does not contain fractions. See http://msdn.microsoft.com/en-us/library/aa394262%28VS.85%29.aspx for the definition of the "Win32_PerfFormattedData_PerfDisk_PhysicalDisk" class.