Monitoring Splunk

Perfmon stanza

becksyboy
Communicator

Hi,

we are trying to on board some windows perfmon counters. We can do LogicalDisk, Memory, Network Interface, PhysicalDisk, Process, Processor information, Processor, server.

However we cannot pick up the following. I asked our windows admin to confirm they exist on the servers. I can't find any correct stanza definitions for each type, but below is what we are currently using (for the ones not working)

APP_POOL_WAS

[perfmon://APP_POOL_WAS]
counters = *
instances = *
disabled = 0
interval = 30
mode = multikv
object = *
useEnglishOnly=true
index = windows_perfmon

ASP.NET Applications

[perfmon://ASP.NET_Applications]
counters = *
instances = *
disabled = 0
interval = 30
mode = multikv
object = *
useEnglishOnly=true
index = windows_perfmon

ASP.NET

[perfmon://ASP.NET]
counters = *
instances = *
disabled = 0
interval = 30
mode = multikv
object = *
useEnglishOnly=true
index = windows_perfmon

Cache

[perfmon://Cache]
counters = *
instances = *
disabled = 0
interval = 30
mode = multikv
object = *
useEnglishOnly=true
index = windows_perfmon

HTTP Service Request Queues

[perfmon://HTTP_Service_Request_Queues]
counters = *
instances = *
disabled = 0
interval = 30
mode = multikv
object = *
useEnglishOnly=true
index = windows_perfmon

Paging File

[perfmon://Paging_File]
counters = *
instances = *
disabled = 0
interval = 30
mode = multikv
object = *
useEnglishOnly=true
index = windows_perfmon

W3SVC_W3WP

[perfmon://W3SVC_W3WP]
counters = *
instances = *
disabled = 0
interval = 30
mode = multikv
object = *
useEnglishOnly=true
index = windows_perfmon

WAS_W3WP

[perfmon://WAS_W3WP]
counters = *
instances = *
disabled = 0
interval = 30
mode = multikv
object = *
useEnglishOnly=true
index = windows_perfmon

Web Service

[perfmon://Web_Service]
counters = *
instances = _Total
disabled = 0
interval = 30
mode = multikv
object = *
useEnglishOnly=true
index = windows_perfmon

Tags (1)
0 Karma

adonio
Ultra Champion

You can find all of them if you have a full Splunk instance installed on a windows server
navigate to "Settings" (top right) -> click: "Data Inputs" -> click "Local Performance Monitoring" -> click: "New Local Performance -Monitoring" -> use the drop down to pick up the relevant object -> add counters -> add instances -> select and continue with the wizard.
see attached screen shot:
alt text

here is teh stanza for the WEB perfmon data:

  [perfmon://WEB]
    counters = xxxxxx
    index = perfmon
    instances = Default Web Site;_Total
    interval = 30
    object = Web Service
    disabled = 1

note, there were too many counters that i enabled to put in this box
here is a screen shot of the web perfmon data:

alt text

hope it helps

0 Karma

becksyboy
Communicator

copy/paste missed off the wild cards after =

counters = *
instances = *
object = *

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...