topic Re: Windows Process in Getting Data In

Windows Process

itsomana — Thu, 17 May 2012 12:01:39 GMT

On a Windows 2003 there is a process running in windows called java.exe. Do you know of a way that Splunk can monitor that java.exe and alert if it is not running.

My approach is to write a script/bat file which runs tasklist. This would be scheduled to run every 5 minutes and would pipe the information out to a file. This file would then be indexed by Splunk. Within Splunk I could search this file and if java.exe is found send out an alert me.

For reference the server is running a Splunk forwarder

Thanks in advance.

Re: Windows Process

Takajian — Fri, 18 May 2012 01:12:42 GMT

I think your approach is right. But your script/bat files is not necessary to write file for splunk indexing. As splunk can do scripted input, splunk can execute and index the result of the script without tasklist.

Please refer to following site for more infomation.

http://docs.splunk.com/Documentation/Splunk/latest/Developer/ScriptedInputsIntro

Re: Windows Process

saurabh_tek — Sat, 08 Oct 2016 09:51:21 GMT

Is there any other way as well @Takajian. or else can you share the script

Re: Windows Process

rvany — Mon, 13 Aug 2018 10:08:14 GMT

For reference - the link has (some years later 😉 ) - changed:
http://docs.splunk.com/Documentation/Splunk/latest/AdvancedDev/ScriptedInputsIntro