https://community.splunk.com/t5/Splunk-Enterprise/Finding-the-top-10-or-15-processes-in-taskmgr-search-query/m-p/30641#M8532 <P>Do you want to see statistics of process on Windows server? If so, you can install Windows app. This may be the easiest way to do. The site is following.</P> <P><A href="http://splunk-base.splunk.com/apps/22315/splunk-for-windows">http://splunk-base.splunk.com/apps/22315/splunk-for-windows</A></P> <P>Following command will show you max cpu load by process name. Hope this help.</P> <P>source=WMI:localprocesses Name!=Total | rex field=Name "(?<NAME>[^#]+)#\d+$" | eval CPULoad = PercentProcessorTime | stats avg(CPULoad) by Name</NAME></P> Wed, 07 Dec 2011 23:23:47 GMT Takajian 2011-12-07T23:23:47Z https://community.splunk.com/t5/Splunk-Enterprise/Finding-the-top-10-or-15-processes-in-taskmgr-search-query/m-p/30640#M8531 <P>Hey folks. Im new to splunk ive been created a bunch of different useful dashboards but i could not figure out how to do the following:</P> <P>top 10 or 15 processes within task mgr.</P> <P>I already have my perfmon.conf configured to forward a bunch of counters already. are there any counters in particular that I would need to help with this search query?</P> <P>thank you very much for you input. </P> <P>Scott</P> Wed, 07 Dec 2011 20:46:18 GMT https://community.splunk.com/t5/Splunk-Enterprise/Finding-the-top-10-or-15-processes-in-taskmgr-search-query/m-p/30640#M8531 saccam447 2011-12-07T20:46:18Z https://community.splunk.com/t5/Splunk-Enterprise/Finding-the-top-10-or-15-processes-in-taskmgr-search-query/m-p/30641#M8532 <P>Do you want to see statistics of process on Windows server? If so, you can install Windows app. This may be the easiest way to do. The site is following.</P> <P><A href="http://splunk-base.splunk.com/apps/22315/splunk-for-windows">http://splunk-base.splunk.com/apps/22315/splunk-for-windows</A></P> <P>Following command will show you max cpu load by process name. Hope this help.</P> <P>source=WMI:localprocesses Name!=Total | rex field=Name "(?<NAME>[^#]+)#\d+$" | eval CPULoad = PercentProcessorTime | stats avg(CPULoad) by Name</NAME></P> Wed, 07 Dec 2011 23:23:47 GMT https://community.splunk.com/t5/Splunk-Enterprise/Finding-the-top-10-or-15-processes-in-taskmgr-search-query/m-p/30641#M8532 Takajian 2011-12-07T23:23:47Z https://community.splunk.com/t5/Splunk-Enterprise/Finding-the-top-10-or-15-processes-in-taskmgr-search-query/m-p/30642#M8533 <P>I already have the Windows app installed. The problem is that im using perfmon:* instead of WMI:* for all my counters. Is there a way where that seatrch query can be modified for perfmon:* ... ? Or is WMI easier for this type of query?</P> <P>Hope I am making sense.</P> <P>Scott</P> Thu, 08 Dec 2011 18:57:49 GMT https://community.splunk.com/t5/Splunk-Enterprise/Finding-the-top-10-or-15-processes-in-taskmgr-search-query/m-p/30642#M8533 saccam447 2011-12-08T18:57:49Z https://community.splunk.com/t5/Splunk-Enterprise/Finding-the-top-10-or-15-processes-in-taskmgr-search-query/m-p/30643#M8534 <P>This is what I did below: I also made sure that my perfmon.conf file had all of the necessary instances and counters for the perfmon counter i created below. </P> <P>source="perfmon:process percent processor time" host="las-p-pd-sql*" instance= * | chart max(Value) as MaxCPU, by instance,host</P> <P>This worked perfectly for what I needed. The Chart and Table is very useful to look for a spike.</P> <P>But Thank you Takajian for your help.</P> Mon, 12 Dec 2011 20:21:55 GMT https://community.splunk.com/t5/Splunk-Enterprise/Finding-the-top-10-or-15-processes-in-taskmgr-search-query/m-p/30643#M8534 saccam447 2011-12-12T20:21:55Z