Getting Data In

Why is Perfmon data not coming to splunk?

rawno
Engager

Splunkd log >>
ERROR ExecProcessor - message from ""C:\Program Files\SplunkUniversalForwarder\bin\splunk-perfmon.exe"" splunk-perfmon - PerfmonHelper::enumObjectNames: PdhEnumObjects failed with (0x800007d0): Unable to connect to the specified computer or the computer is offline.\r\n
Error "Unable to connect to the specified computer or the computer is offline." meaning splunk perfmon cannot connect to windows perfmon.
Check if you can open windows performance monitor.
If you get the following :
“UNABLE TO ADD THESE COUNTERS”
\Memory\Available MBytes
\Memory\% Committed Bytes In Use
\Memory\Cache Faults/sec
\Memory\Cache Faults/sec
\PhysicalDisk()\%Idle Time
\PhysicalDisk(
)\Avg. Disk Queue Length
\Network Interface(*)\Bytes Total/sec”

0 Karma
1 Solution

rawno
Engager

issue was with host machines windows perfmon. Splunk-perfmon couldn't communicate to windows due to corrupt windows perfmon.

Follow the steps below:
1. Launch Command Prompt as Administrator (right click Runs As Administrator).
2. Drop into the C:\WINDOWS\System32 directory by typing CD\ then CD Windows\System32
3. To rebuild your resource counters type the following command:
lodctr /r
Restart the splunk-forwarder service and it should resolve this particular issue.

View solution in original post

rawno
Engager

issue was with host machines windows perfmon. Splunk-perfmon couldn't communicate to windows due to corrupt windows perfmon.

Follow the steps below:
1. Launch Command Prompt as Administrator (right click Runs As Administrator).
2. Drop into the C:\WINDOWS\System32 directory by typing CD\ then CD Windows\System32
3. To rebuild your resource counters type the following command:
lodctr /r
Restart the splunk-forwarder service and it should resolve this particular issue.

skalliger
Motivator

So, what did you try to solve the issue? It's stating that Splunk can't connect to the remote machine.

0 Karma
Career Survey
First 500 qualified respondents will receive a $20 gift card! Tell us about your professional Splunk journey.
Get Updates on the Splunk Community!

Tech Talk Recap | Mastering Threat Hunting

Mastering Threat HuntingDive into the world of threat hunting, exploring the key differences between ...

Observability for AI Applications: Troubleshooting Latency

If you’re working with proprietary company data, you’re probably going to have a locally hosted LLM or many ...

Splunk AI Assistant for SPL vs. ChatGPT: Which One is Better?

In the age of AI, every tool promises to make our lives easier. From summarizing content to writing code, ...