Why Windows perfmon sourcetypes with stanza names "Perfmon:System" and "Perfmon:Process" do not get any data?

[caagrawal]

This is very strange issue I am experiencing with Spunk 6.2.1. I have SplunkUniversalForwarder setup on Windows 2008 (R2) box.

/apps/Splunk_TA_Windows/local/inputs.conf config file contains following stanzas. However, with sourcetypes Perfmon:System or Perfmon:Process, I am not getting any data in Splunk. If I change the stanza name and replace Process with say WinProcess and System with WinSystem, then I get the data with sourcetypes Perfmon:WinProcess and Perfmon:WinSystem. I am not sure whats going wrong here when I use stanza name to have System or Process.

Please help. In one Answers post:
http://answers.splunk.com/answers/113708/performance-monitoring-not-working-on-windows-app.html

I read that we should have stanza names to have Windows__ prefix. But I don't think its mandatory to have stanza names like that.

Example stanza NOT working:
[perfmon://System]
counters = *
instances = *
interval = 120
object = System
disabled = 0

[perfmon://Process]
counters = *
instances = *
interval = 120
object = Processor
disabled = 0

Example stanza working:
[perfmon://WinSystem]
counters = *
instances = *
interval = 120
object = System
disabled = 0

[perfmon://WinProcess]
counters = *
instances = *
interval = 120
object = Processor
disabled = 0

[ansif]

Try to access Windows performance monitor and check the names of the counter.Might be Windows 2008 has different counter names.