Getting Data In

Monitor memory performance for windows servers

Pooja1
Loves-to-Learn Everything

Hi Team,

As we need to monitor memory by process for each windows hosts. As checked we couldn't find any processes for memory and instances value is showing only "0" but we are monitoring CPU by process for hosts, it contains instance field and we could see the processes name for CPU. We verified the inputs.conf stanzas everything is looking good need your help to configure this memory processes in the instances field.

Below are query used to populate CPU utilization by process
index=perfmon source="Perfmon:Process" counter="% Processor Time" instance!=_total instance!=idle | timechart limit=20 useother=f span=10m max(Value) as cputime by instance


So, we need same for memory utilization by process, and the counter = "% Committed Bytes In Use"

Thanks

Labels (4)
0 Karma

richgalloway
SplunkTrust
SplunkTrust

This is the full set of process performance metrics that Splunk makes available to us.

% Processor Time, % User Time, % Privileged Time, Virtual Bytes Peak, Virtual Bytes, Page Faults/sec, Working Set Peak, Working Set, Page File Bytes Peak, Page File Bytes, Private Bytes, Thread Count, Priority Base, Elapsed Time, ID Process, Creating Process ID, Pool Paged Bytes, Pool Nonpaged Bytes, Handle Count, IO Read Operations/sec, IO Write Operations/sec, IO Data Operations/sec, IO Other Operations/sec, IO Read Bytes/sec, IO Write Bytes/sec, IO Data Bytes/sec, IO Other Bytes/sec, Working Set - Private

If you need other metrics, then perhaps there is third-party software available to collect the values and send them to Splunk.

---
If this reply helps you, Karma would be appreciated.
0 Karma

Pooja1
Loves-to-Learn Everything

Hi @richgalloway 

Can I know what kind of third party software should be available to collect the value and send it to Splunk?

Because I need "% Committed Bytes In Use" should be present in Perfmon :Process stanza , means  this "% Committed Bytes In Use" should be present in that counter list. so how can get this added?


Thanks

0 Karma

richgalloway
SplunkTrust
SplunkTrust

I don't know which third-party software offers that counter, if it's even available at all.

---
If this reply helps you, Karma would be appreciated.
0 Karma

Pooja1
Loves-to-Learn Everything

Hi @richgalloway,

Can we add "% Committed Bytes In Use" to Perfmon : Process??

Because I could see % Committed Byes In Use counter in Perfmon : Memory

I already tried to add that counter to Process source but no luck... is there any way to add??

Thanks

0 Karma

richgalloway
SplunkTrust
SplunkTrust

You can add anything you like to any perfmon stanza, but that doesn't mean it will work.  Only the documented (in Settings->Data input->Local performance monitoring) counters will work.

---
If this reply helps you, Karma would be appreciated.
0 Karma

Pooja1
Loves-to-Learn Everything

Hai @richgalloway ,

Using Splunk Web, I go to 'Data inputs' > 'Local performance monitoring' > Selected the input that are created
I see the following errors: Failed to fetch data: Admin handler 'win-perfmon-find-collection' not found.
This error is displayed for 'Available objects', 'Counters', 'Instances'

How can I resolve this error?

Thanks

0 Karma

richgalloway
SplunkTrust
SplunkTrust

Is the GUI running on a Windows machine?  If not, they I believe you will get an error like that since there are no local Windows performance inputs.  Instead, you'll need Remote Performance Monitoring.

---
If this reply helps you, Karma would be appreciated.

Pooja1
Loves-to-Learn Everything

Hi @richgalloway ,

I added only "% Processor Time" & "Working Set - Private" in Process source stanza it is taking all the other 28 counters.

Before counters = * > then it shows all the 28 counters. 
But, now I added only 2 counters ("% Processor Time" & "Working Set - Private") even though it is showing other counters also.

Please help me with this..

Thanks,
Pooja

0 Karma

richgalloway
SplunkTrust
SplunkTrust

I don't have the same experience.  When I select those two counters I get those two plus process_mem_used and process_cpu_used_percent, which appear to be duplicates of the selected counters.  I don't know how to help you from here.

---
If this reply helps you, Karma would be appreciated.
0 Karma

Pooja1
Loves-to-Learn Everything

Hi @richgalloway ,

Thank you for the support.

Thanks

0 Karma
Get Updates on the Splunk Community!

Adoption of RUM and APM at Splunk

    Unleash the power of Splunk Observability   Watch Now In this can't miss Tech Talk! The Splunk Growth ...

March Community Office Hours Security Series Uncovered!

Hello Splunk Community! In March, Splunk Community Office Hours spotlighted our fabulous Splunk Threat ...

Stay Connected: Your Guide to April Tech Talks, Office Hours, and Webinars!

Take a look below to explore our upcoming Community Office Hours, Tech Talks, and Webinars in April. This post ...