help with setting up windows perfmon in the universal forwarder

[ebailey]

I am trying to get a few perfmon counters setup in the universal forwarder for Windows 2012 without much luck.

I am getting the following error

05-21-2015 16:45:14.950 -0500 ERROR ExecProcessor - message from ""C:\Program Files\SplunkUniversalForwarder\bin\splunk-perfmon.exe"" splunk-perfmon - PdhEnumObjectItems returned error 0xc0000bb8 for object '.NET CLR Exceptions'.
05-21-2015 16:45:14.950 -0500 ERROR ExecProcessor - message from ""C:\Program Files\SplunkUniversalForwarder\bin\splunk-perfmon.exe"" splunk-perfmon - getAllInstancesCounters failed in PeriodicDataCollector::enumInstancesCounters

Any ideas are very welcome.

Here is my inputs.conf

Performance Monitors -------------------------------------------------------------------------------------

[perfmon://CPU]
disabled = false
counters = *
instances = *
interval = 10
object = Processor
useEnglishOnly = true

[perfmon://LogicalDisk]
disabled = false
counters = % Free Space; Free Megabytes; % Disk Time; Avg. Disk sec/Read; Avg. Disk sec/Write; Avg. Disk sec/Transfer; Disk Reads/sec; Disk Writes/sec;
instances = *
interval = 10
object = LogicalDisk
useEnglishOnly = true

[perfmon://Memory]
disabled = false
counters = % Committed Bytes In Use; Committed Bytes; Available MBytes; Page Reads/sec, Page Writes/sec; Page Faults/sec; Transition Faults/sec;
interval = 10
object = Memory
useEnglishOnly = true

[perfmon://Network]
disabled = false
counters = Bytes Received/sec; Bytes Sent/sec; Bytes Total/sec;
instances = *
interval = 10
object = Network Interface
useEnglishOnly = true

[perfmon://System]
disabled = false
counters = System Up Time; Processor Queue Length;
instances = *
interval = 60
object = System
useEnglishOnly = true

[perfmon://.NET CLR Exceptions]
disabled = false
counters = *;
instances = *
interval = 10
object = .NET CLR Exceptions
useEnglishOnly = true

[perfmon://.NET CLR Memory]
disabled = false
counters = *;
instances = *
interval = 10
object = .NET CLR Memory
useEnglishOnly = true

[perfmon://ASP.NET]
disabled = false
counters = *;
instances = *
interval = 10
object = ASP.NET
useEnglishOnly = true

[perfmon://ASP.NET Applications]
disabled = false
counters = *;
instances = *
interval = 10
object = ASP.NET Applications
useEnglishOnly = true

[perfmon://Web Service]
disabled = false
counters = *
instances = *
interval = 10
object = Web Service
useEnglishOnly = true

[perfmon://MSMQ Service]
disabled = false
counters = *
instances = *
interval = 10
object = MSMQ Service
useEnglishOnly = true

[perfmon://MSMQ Session]
disabled = false
counters = *
instances = *
interval = 10
object = MSMQ Session
useEnglishOnly = true

[perfmon://MSMQ Queue]
disabled = false
counters = *
instances = *
interval = 10
object = MSMQ Queue
useEnglishOnly = true

[dstaulcu]

It is possible that one or more of the performance counters you have an input for are corrupted. Disable all counters and add back one at a time until you find out which input/counter is causing the problem.

[neelamssantosh]

Just for troubleshooting/check,
if your wmi service on windows are running/started.

Restart the splunk service if still doesn't workout.

Share the recent logs