I am trying to find the format for a perfmon input to collect the following from a universalforwarder but am not sure about the format of the stanza
SQLServer:Databases
Dara File(s) Size (KB)
Also, do i need to enable that from within SQL or Perfmon itself?
The weird thing is I have the stanza below enabled, but only get data from one of my 150+ servers that have the same exact config and cant figure out why only one works.
[perfmon://SQLServer_SQL_Statistics]
object = MSSQL\$.*:SQL Statistics
counters = *
instances = *
interval = 30
disabled = 0
Finally corrected the issue. It was a matter of correctly supplying the object name in the right format.
like this
object = SQLServer:Databases
not
object = MSSQL:Databases
Not sure why some are one way and others are the other, but this worked for me.
can you explain in detail how this is done for a beginner? i'm not sure what query i need to place in the search to get this result any help would be greatly appreciated
Finally corrected the issue. It was a matter of correctly supplying the object name in the right format.
like this
object = SQLServer:Databases
not
object = MSSQL:Databases
Not sure why some are one way and others are the other, but this worked for me.
Go to Perfmon if you have logon access to the machine.
Check all the instances for the databases object which you want to monitor rather that using *. If you don't see the database in the list splunk will not as well
Moreover you can also monitor the size using sql script as well. Search for how to check database size using sql and trigger the same using sqlcmd in the bat file.
Thanks,
L
BTW I do have an asterisk after counters in both stanzas above, it just doesn't show right for some reason when i post it.
Update - I was able to get some additional data to come from the one server i was already getting data from. I noticed that the data is regarding a different DB than the one i am interested in that the customer added to the box. His other DB is in the default location, but the one i want is on a different drive and path. Could the location be affecting something? Would I need to alter the regex? This version below seems to work for me, just not for the right DB.
[perfmon://SQLServer_Databases]
object = MSSQL\$.*:Databases
counters = *
instances = *
interval = 30
disabled = 0