The venerable old-skool Splunk forums are now closed. Feel free to search for old content here, but new posts are no longer supported.

Instead, please visit the thriving community at answers.splunk.com to ask and answer questions about your Splunk deployment and how to get the most out of it.

Forums: SplunkAdministration: Missing WMI Instances

Previous Topic: Splunk 4 Performance Tuning  |   Next Topic: Overriding sendemail in commands.conf


Posts 1–3 of 3
1
posted by: esc67  |  posts
date: November 20, 2009
permalink

I have created custom perf counters. I see them in PerfMon just fine, but when I try to add them to Splunk, I don't see any instances. The WMI category and fields are there. However, when I choose "Selected" under Available Instances the box is empty. If I choose "All" then I simply don't get any data in Splunk.

Here's the WQL:

SELECT Name, active FROM Win32_PerfRawData_RobloxFarmsAppServer_RobloxFarmsAppServer

I ran my WQL in Scriptomatic and it returned results, but Splunk isn't gathering data. How do I debug this?

-Erik

2
posted by: gkanapathy  |  posts
date: November 21, 2009
permalink

Are other Perfmon counters (the out of the box ones that come with Splunk like CPUTime or whatever) collecting? Do you have the Splunk Windows app enabled?

3
posted by: esc67  |  posts
date: November 24, 2009
permalink

Yes, out-of-the-box counter work fine. I can also add several of the standard Windows perfmon counters that don't come with Splunk. The custom counters in question do work on some servers, but not others.

So here is what I know:

1) All servers have splunk installed locally

2) All splunk instances are recording windows counters like ".NET LocksAndThreads" successfully

3) wmi.conf is the same across all servers

4) All servers are reporting my custom counters in perfmon

5) * some servers report my custom counters in Splunk, but others don't *