What is the (*) in Windows Performance Counters

The asterisk stands for "All Instances," which includes _Total where applicable.

Perfmon is probably the easiest place to look at the counters and see what's available on your system.

From the documentation for typeperf:

•Counter path format 

The general format for counter paths is as follows: [\\Computer]\object[parent/instance#index]\counter] where:

The parent, instance, index, and counter components of the format may contain either a valid name or a wildcard character. The computer, parent, instance, and index components are not necessary for all counters.

You determine the counter paths to use based on the counter itself. For example, the LogicalDisk object has an instance index, so you must provide the #index or a wildcard. Therefore, you could use the following format:

\LogicalDisk(*/*#*)\*

In comparison, the Process object does not require an instance index. Therefore, you could use the following format:

\Process(*)\ID Process

The following is a list of the possible formats: ◦ \\machine\object(parent/instance#index)\counter 

◦ \\machine\object(parent/instance)\counter 

◦ \\machine\object(instance#index)\counter 

◦ \\machine\object(instance)\counter 

◦ \\machine\object\counter 

◦ \object(parent/instance#index)\counter 

◦ \object(parent/instance)\counter 

◦ \object(instance#index)\counter 

◦ \object(instance)\counter 

◦ \object\counter

Edit: Oh, and don't forget to check out Get-Counter in Powershell:

PS C:\> (Get-Counter -ListSet Memory).Paths

\Memory\Page Faults/sec
\Memory\Available Bytes
\Memory\Committed Bytes
\Memory\Commit Limit
\Memory\Write Copies/sec
\Memory\Transition Faults/sec
\Memory\Cache Faults/sec
\Memory\Demand Zero Faults/sec
\Memory\Pages/sec
\Memory\Pages Input/sec
...

The second command gets the path names that include "cache".
PS C:\> (Get-Counter -ListSet Memory).Paths | Where {$_ -like "*Cache*"}

\Memory\Cache Faults/sec
\Memory\Cache Bytes
\Memory\Cache Bytes Peak
\Memory\System Cache Resident Bytes
\Memory\Standby Cache Reserve Bytes
\Memory\Standby Cache Normal Priority Bytes
\Memory\Standby Cache Core Bytes

The answer is right. I'd like to add that it's possible to use parent* to use all instances. See http://www.codeproject.com/Articles/369888/Diagnosing-applications-using-Performance-Counters

E.g. "\Thread(w3wp*)\Context Switches/sec" lists all threads in w3wp process

I didn't find this listed anywhere. Also PowerShell complains, but it works...