Perfmon stanza

[becksyboy]

Hi,

we are trying to on board some windows perfmon counters. We can do LogicalDisk, Memory, Network Interface, PhysicalDisk, Process, Processor information, Processor, server.

However we cannot pick up the following. I asked our windows admin to confirm they exist on the servers. I can't find any correct stanza definitions for each type, but below is what we are currently using (for the ones not working)

APP_POOL_WAS

[perfmon://APP_POOL_WAS]
counters = *
instances = *
disabled = 0
interval = 30
mode = multikv
object = *
useEnglishOnly=true
index = windows_perfmon

ASP.NET Applications

[perfmon://ASP.NET_Applications]
counters = *
instances = *
disabled = 0
interval = 30
mode = multikv
object = *
useEnglishOnly=true
index = windows_perfmon

ASP.NET

[perfmon://ASP.NET]
counters = *
instances = *
disabled = 0
interval = 30
mode = multikv
object = *
useEnglishOnly=true
index = windows_perfmon

Cache

[perfmon://Cache]
counters = *
instances = *
disabled = 0
interval = 30
mode = multikv
object = *
useEnglishOnly=true
index = windows_perfmon

HTTP Service Request Queues

[perfmon://HTTP_Service_Request_Queues]
counters = *
instances = *
disabled = 0
interval = 30
mode = multikv
object = *
useEnglishOnly=true
index = windows_perfmon

Paging File

[perfmon://Paging_File]
counters = *
instances = *
disabled = 0
interval = 30
mode = multikv
object = *
useEnglishOnly=true
index = windows_perfmon

W3SVC_W3WP

[perfmon://W3SVC_W3WP]
counters = *
instances = *
disabled = 0
interval = 30
mode = multikv
object = *
useEnglishOnly=true
index = windows_perfmon

WAS_W3WP

[perfmon://WAS_W3WP]
counters = *
instances = *
disabled = 0
interval = 30
mode = multikv
object = *
useEnglishOnly=true
index = windows_perfmon

Web Service

[perfmon://Web_Service]
counters = *
instances = _Total
disabled = 0
interval = 30
mode = multikv
object = *
useEnglishOnly=true
index = windows_perfmon

[adonio]

You can find all of them if you have a full Splunk instance installed on a windows server
navigate to "Settings" (top right) -> click: "Data Inputs" -> click "Local Performance Monitoring" -> click: "New Local Performance -Monitoring" -> use the drop down to pick up the relevant object -> add counters -> add instances -> select and continue with the wizard.
see attached screen shot:

here is teh stanza for the WEB perfmon data:

  [perfmon://WEB]
    counters = xxxxxx
    index = perfmon
    instances = Default Web Site;_Total
    interval = 30
    object = Web Service
    disabled = 1

note, there were too many counters that i enabled to put in this box
here is a screen shot of the web perfmon data:

hope it helps

[becksyboy]

copy/paste missed off the wild cards after =

counters = *
instances = *
object = *