topic Re: Splunk won't index Perfmon Process object in Getting Data In

Splunk won't index Perfmon Process object

gregbo — Fri, 21 Jun 2019 15:00:25 GMT

I have splunk getting data for the other objects, including Processor, but nothing happens for Process.

The process stanza:

[perfmon://Process]
interval = 60
object = Process
counters = _Total
instances = *
index = windows
showZeroValue = 1
disabled = 0

The processor stanza:

[perfmon://Proccesor]
interval = 60
object = Processor
counters = *
instances = *
index = windows
showZeroValue = 1

Re: Splunk won't index Perfmon Process object

skalliger — Fri, 21 Jun 2019 18:11:10 GMT

Is that correct what you wrote? Because "Process" is written correct, the "Proccesor" stanza however isn't. Does the user have all required permissions?

Re: Splunk won't index Perfmon Process object

gregbo — Mon, 24 Jun 2019 10:49:03 GMT

There's a Process object and a Processor object in Perfmon. The Processor object works fine. The user has all the necessary rights.

Re: Splunk won't index Perfmon Process object

skalliger — Tue, 25 Jun 2019 19:08:03 GMT

Then I can only suggest to file a support case and get some troubleshooting steps. I'm no Windows expert. 😕

Skalli

Re: Splunk won't index Perfmon Process object

amitm05 — Tue, 25 Jun 2019 20:11:28 GMT

@gregbo
Couple of queries - Can you mention where are you trying to get the perfmon data from ? Is this from local Splunk instance Or forwarder based ? To which user are you setting the permission ?