topic How to get a count from certain process on multiple machines? in Splunk Enterprise

How to get a count from certain process on multiple machines?

coldwolf7 — Fri, 30 Jun 2023 15:52:18 GMT

Hello,

So am trying to get a report of how many times in a month a certain process runs on a machine and when the last it did

index=wss_desktop_perfmon sourcetype="wks:Perf_Process" instance!="_Total" instance!="idle"
| where instance like "%bplus.wtk%"

So this is the start of the search. The process bplus.wtk in splunk can have multiple instances like

bplus.wtk2#1

bplus.wtk2#2

bplus.wtk2#3

I do not care about the info past bplus.wtk I just want a count of how many times that shows up in month on a machine and count it

On that machine I want a report that looks like

Computer	bplus.wtk	Last Time it Ran
workstation1	100	6/23/2023
workstation2	250	6/27/2023

I have tried Stats count and it is not working because I think it is a string value I am looking at and not a number value.

Any help is appreciated

Re: How to get a count from certain process on multiple machines?

isoutamo — Tue, 04 Jul 2023 13:04:16 GMT

I think that something like this should work

index=wss_desktop_perfmon sourcetype="wks:Perf_Process" instance="*" instance!="_Total" instance!="idle" | where instance like "%bplus.wtk%" | stats count as "bplus.wtk" max(_time) as lastRun by Computer | eval lastRun = strftime(lastRun, "%m/%d/%Y") | table Computer "bplus.wtk" lastRun

Usually you should add that instance = "*xyz*" on first line, but as you have wildcard also in the beginning on it, it could be better (in point of performance) to have it separately? You should check it by Job Inspector. Also check if those instance!=xyz are better to drop or not as you are selecting only some specific instances on second line. Splunk is not good for != and NOT (in performance point of view).

r. Ismo

Re: How to get a count from certain process on multiple machines?

coldwolf7 — Wed, 05 Jul 2023 18:29:57 GMT

That worked perfectly. I did take out the where statement and put the instance = "*xyz*" on the first line and took out the != and ran so much faster