Unable to ingest the Perfmon metrics data into splunk using splunk add-on for Microsoft Windows.

Applicability

Description

While attempting to ingest data using the Splunk Add-on for Windows, Perfmon data is not appearing in Splunk.

Investigation

Search below SPL in the Search and Reporting App:

index=_internal sourcetype=splunkd *Perfmon*

Below error was observed:

07-19-2024 18:58:51.705 +0700 ERROR ExecProcessor [8124 ExecProcessor] - message from ""C:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exe"" WinEventCommonChannel - Did not bind to the closest Domain Controller, a further domain controller has been bound.

Based on the above error message it says that the splunk forwarder service is running by using the local account instead of the Domain account.

Resolution

In order to resolve this issue, please change the account from a Local account to a Domain Account for running the splunk forwarder services.
You may reach out to Window server admin to update the same as there could be a permission level error while making a change with normal local account.

Post making the changes, restart the splunk services on the Splunk Forwarder.