Refine your search:

I have a scripted input that gather SQL Perfmon counters via wmi. It is gathering data and working without issue, however we need to edit it to gather more SQLServer Locks Counters. Below are the entries in the Inputs.Conf, Props.Conf and Transforms.Conf files as well as the .bat file and counters we are calling. I can add counters and these will be gathered without issue however splunk will fail to put it into the intended 'buckets' I list in the Tranforms.Conf file. In fact if I even try to simply change the name of the Format column in the Transforms.conf it does not register in splunk. It is as if once the data is indexed it does not like changes. Also is there a limit on how many REGEX and FORMAT columns I can specify for any scripted input in the Transforms.conf? Any help would be appreciated.

Thank You

Inputs.Conf

[script://$SPLUNK_HOME\etc\apps\sqlwmi\bin\sqlwmi-locks.bat]
interval = 120 
index = sqlserver
sourcetype = WMI:SQLServer:Locks
source = script://sqlwmi-locks.bat

sqlwmi-locks.bat

@echo off
IF EXIST "C:\program files\splunk\etc\apps\sqlwmi\bin" typeperf -cf "C:\program files\splunk\etc\apps\sqlwmi\bin\sql-locks-counters.txt" -sc 1
IF EXIST "D:\program files\splunk\etc\apps\sqlwmi\bin" typeperf -cf "D:\program files\splunk\etc\apps\sqlwmi\bin\sql-locks-counters.txt" -sc 1

sql-locks-counters.txt

\SQLSERVER:Locks(_Total)\Lock Requests/sec
\SQLSERVER:Locks(_Total)\Number of Deadlocks/sec
\SQLSERVER:Locks(_Total)\Lock Waits/sec
\SQLSERVER:Locks(_Total)\Lock Wait Time (ms)
\SQLSERVER:Locks(_Total)\Lock Timeouts/sec

Props.Conf

[source::script://sqlwmi-locks.bat]
LINE_BREAKER = ""
SHOULD_LINEMERGE = true
TRANSFORMS-locks = locks

Transforms.conf

[locks]
DEST_KEY = _raw
REGEX = (?im)"(.*)","([0-9]*\.[0-9]*)","([0-9]*\.[0-9]*)","([0-9]*\.[0-9]*)","([0-9]*\.[0-9]*)","([0-9]*\.[0-9]*)"
FORMAT = $1 LockRequestsPerSec=$2 NumberOfDeadlocksPerSec=$3 LockWaitsPerSec=$4 LockWaitTimeMS=$5 LockTimoutsPerSec=$6

asked 06 Dec '10, 20:05

JOverbey's gravatar image

JOverbey
1
accept rate: 0%

edited 06 Dec '10, 20:09

ziegfried's gravatar image

ziegfried ♦
7.2k1315

Be the first one to answer this question!
toggle preview

Follow this question

Log In to enable email subscriptions

RSS:

Answers

Answers + Comments

Markdown Basics

  • *italic* or _italic_
  • **bold** or __bold__
  • link:[text](http://url.com/ "Title")
  • image?![alt text](/path/img.jpg "Title")
  • numbered list: 1. Foo 2. Bar
  • to add a line break simply add two spaces to where you would like the new line to be.
  • basic HTML tags are also supported

Tags:

×89

Asked: 06 Dec '10, 20:05

Seen: 488 times

Last updated: 06 Dec '10, 20:09

Copyright © 2005-2012 Splunk, Inc. All rights reserved.