topic Re: filtering process information in Getting Data In

filtering process information

noliver — Fri, 07 Feb 2014 20:52:22 GMT

Hi,

I'm looking to get individual process performance data from Splunk, but only specific processes. (to reduce data)

What I have entered is:

[perfmon://Process]

index = main

object = Process

counters = Working Set - Private;Elapsed Time;% Processor Time;% UserTime

instances = process1;process2;process3

But it is still bringing back all process information for all processes. Does anyone know why its is not forwarding the data specified only?

Thanks

Re: filtering process information

MuS — Sun, 09 Feb 2014 19:46:13 GMT

Hi noliver,

are you applying this props.conf on the universal forwarder or the indexer? It will not work on the forwarder, since it does not parse the data/events. You must apply it on the indexer or a heavy forwarder, they do data/event parsing.

Also, check that the name in the stanza is correct for this source type. Check the docs on route and filter data

hope this helps ...

cheers, MuS

Re: filtering process information

mic1024 — Mon, 10 Feb 2014 18:25:25 GMT

I think noliver is talking about the inputs.conf configuration rather than props.conf

Re: filtering process information

barbituate — Wed, 09 Jul 2014 17:59:59 GMT

I'm in the same boat. I'd like to have control over which process data is being gathered to conserve my license bandwidth. As it stands now, 10GB is being used by Perfmon :Process alone! I'm only interested in maybe 5 processes.