topic Re: How to exclude or filter 0% window process from hostmetrics - process in Getting Data In

How to exclude or filter 0% window process from hostmetrics - process?

fongpen — Wed, 26 Oct 2022 14:04:15 GMT

Hi Guru,

How do we exclude 0% process usage from Hostmetrics? We would like to capture those process have >0% usage only..

Appreciate if you can provide the sample.

hostmetrics:
collection_interval: 10s
scrapers:
# System processes metrics, disabled by default
process: (filter / exclude 0% process usage)

Re: How to exclude or filter 0% window process from hostmetrics - process

ITWhisperer — Wed, 24 Aug 2022 06:31:31 GMT

Please can you provide some sanitised events so we can see what you are dealing with?

Re: How to exclude or filter 0% window process from hostmetrics - process

fongpen — Wed, 24 Aug 2022 06:45:20 GMT

I would like to have something like this:-

PS > Get-Counter '\Process(*)\% Processor Time' -ErrorAction SilentlyContinue | Select-Object -ExpandProperty CounterSamples | Sort-Object -Property cookedvalue -Descending | Where-Object CookedValue -gt 0

*** There are thousand of 0% process which wasted a lot of space and custom metrics license.

Re: How to exclude or filter 0% window process from hostmetrics - process

ITWhisperer — Wed, 24 Aug 2022 06:50:05 GMT

Please provide some sample raw events that you are trying to ingest, both the ones you want to keep and the one you want to exclude.

Re: How to exclude or filter 0% window process from hostmetrics - process

fongpen — Wed, 24 Aug 2022 07:24:45 GMT

Samples: -

Include : * Process > 0%

Exclude : * Process = 0%

Re: How to exclude or filter 0% window process from hostmetrics - process

ITWhisperer — Wed, 24 Aug 2022 07:45:10 GMT

These appear to be screenshots - Splunk doesn't ingest these very well.

Re: How to exclude or filter 0% window process from hostmetrics - process

fongpen — Wed, 26 Oct 2022 09:28:03 GMT

Replied from Splunk Support : unfortunately, it looks like it's not possible to exclude process metrics which have 0% value