I'm trying to get Splunk to return the below Perfmon Counters, but am getting no results:
\SQLServer:Locks(*)\Number of Deadlocks/sec \SQLServer:Locks(*)\Average Wait Time (ms) \SQLServer:Databases(*)\Log Flushes/sec
Below is part of my inputs.conf for the above counters:
[perfmon://SQLServer:Locks] object = SQLServer:Locks counters = Number of Deadlocks/sec; Average Wait Time (ms); instances = _Total interval = 30 disabled = 0 index=bluedoor_****_perfmon [perfmon://SQLServer:Databases] object = SQLServer:Databases counters = Log Flushes/sec; instances = _Total interval = 30 disabled = 0 index=bluedoor_****_perfmon
My other counters are returning data, but not these (Splunk Forwarder has been restarted etc)?
Am I doing something wrong for these counters?
Hi steveskinner, from my experience, the perfmon input is case sensitive, and the stanza name, object, and counter configurations must line up exactly with what is on the system. Given that Splunk can read at least some of the perfmon counters (i.e., has permission to perfmon in general), I'd expect that there is an issue with the config. My recommendation is to look very carefully at the config. I've used powershell to help troubleshoot this in the past : https://www.simple-talk.com/sysadmin/powershell/powershell-day-to-day-admin-tasks-monitoring-perform...
That can be helpful for getting printouts of the names involved.
Please let me know if this helps!
You are correct after checking through the search string I could see I had missed the 'S' off of 'Databases' and the other counters needed some activity to populate - many thanks for your quick response