How to troubleshoot why I'm not getting any data from our Splunk forwarder for these perfmon counters?

[steveskinner]

Hi,

I'm trying to get Splunk to return the below Perfmon Counters, but am getting no results:

\SQLServer:Locks(*)\Number of Deadlocks/sec
\SQLServer:Locks(*)\Average Wait Time (ms)
\SQLServer:Databases(*)\Log Flushes/sec

Below is part of my inputs.conf for the above counters:

[perfmon://SQLServer:Locks]
object = SQLServer:Locks
counters = Number of Deadlocks/sec; Average Wait Time (ms);
instances = _Total
interval = 30
disabled = 0
index=bluedoor_****_perfmon


[perfmon://SQLServer:Databases]
object = SQLServer:Databases
counters = Log Flushes/sec;
instances = _Total
interval = 30
disabled = 0
index=bluedoor_****_perfmon

My other counters are returning data, but not these (Splunk Forwarder has been restarted etc)?
Am I doing something wrong for these counters?

Kind Regards

Steve

[muebel · Accepted solution]

Hi steveskinner, from my experience, the perfmon input is case sensitive, and the stanza name, object, and counter configurations must line up exactly with what is on the system. Given that Splunk can read at least some of the perfmon counters (i.e., has permission to perfmon in general), I'd expect that there is an issue with the config. My recommendation is to look very carefully at the config. I've used powershell to help troubleshoot this in the past : https://www.simple-talk.com/sysadmin/powershell/powershell-day-to-day-admin-tasks-monitoring-perform...

That can be helpful for getting printouts of the names involved.

Please let me know if this helps!

[steveskinner]

Hi,

You are correct after checking through the search string I could see I had missed the 'S' off of 'Databases' and the other counters needed some activity to populate - many thanks for your quick response

Kind regards

Steve

[muebel]

glad to help! 😄