https://community.splunk.com/t5/Knowledge-Management/New-Splunk-Metrics-logging-interval/m-p/705328/highlight/true#M10338 ... View more

Correct resolution for this issue is to force update content as mentioned in this article (if 1 time force update not work try it 3-4 times it will resolve issue) : https://splunk.my.site.com/customer/s/article/SSE-Security-Content-not-loading-issue-KB-will-complet...  Also it required to have internet connectivity on Splunk Machines to use this App ---- Apply karma and mark solution if works. ... View more

Hi @cpaulraj , I’m a Community Moderator in the Splunk Community. This question was posted 7 years ago, so it might not get the attention you need for your question to be answered. We recommend that you post a new question so that your issue can get the  visibility it deserves. To increase your chances of getting help from the community, follow these guidelines in the Splunk Answers User Manual when creating your post. Thank you!  ... View more

So everything is the same except the metrics are different, the data is different and generally we don't know what and why "doesn't work", right? But seriously. The data is important here as well as what your transform looks like. Look at the Masa diagrams https://community.splunk.com/t5/Getting-Data-In/Diagrams-of-how-indexing-works-in-the-Splunk-platform-the-Masa/m-p/590774 I haven't worked with metrics much but I'd say metric schema is invoked after transforms so you need to filter your data by raw event contents. ... View more

You should create support/bug report to splunk support. Maybe they see this same way and add this to fix list? ... View more

Hi All Has anyone managed to solve this issue without reinstalling UF? We have this problem only on certain Window Servers 2022. Other windows versions are not affected. Also not all Win2022 are affected, only certain machines Command "Get-counter -ListSet *" returns the following error. Could not find any performance counter sets on the computer: error c0000bc8. Verify that the computer exists, that it is discoverable, and that you have sufficient privileges to view performance counter data on that computer Perfmon counters are available for other users on this machine, so there is problem for SplunkForwarder user.  I've used the "lodctr /R" command but issue still persists. The issue occurred immediately after the upgrade to version 9.1.5, so it's definitely Splunk problem ... View more

What is the status of this bug? It still persists in Splunk 9.0.5 and I haven't seen a fix in the release notes for newer versions. ... View more