https://community.splunk.com/t5/Getting-Data-In/How-to-edit-ps-sh-to-limit-process-getting-in-ingest-for-Splunk/m-p/423101#M94215 <P>Hello, <BR /> I'm trying to only get a certain server processes to ingest to splunk index using Splunk Add-on for Unix and Linux script by editing the ps.sh script by adding grep command in there. like below. <BR /> However i'm getting error like <BR /> ERROR: Unsupported option (BSD syntax)<BR /> or<BR /> ERROR: Garbage option.</P> <P>edit:<BR /> CMD='ps auxww|grep nc'</P> <P>Could someone please direct me to document how to add grep in or some guidance how to get this ps.sh script to works?</P> <P>thank you </P> Tue, 21 Aug 2018 20:01:17 GMT tgmvt03 2018-08-21T20:01:17Z https://community.splunk.com/t5/Getting-Data-In/How-to-edit-ps-sh-to-limit-process-getting-in-ingest-for-Splunk/m-p/423101#M94215 <P>Hello, <BR /> I'm trying to only get a certain server processes to ingest to splunk index using Splunk Add-on for Unix and Linux script by editing the ps.sh script by adding grep command in there. like below. <BR /> However i'm getting error like <BR /> ERROR: Unsupported option (BSD syntax)<BR /> or<BR /> ERROR: Garbage option.</P> <P>edit:<BR /> CMD='ps auxww|grep nc'</P> <P>Could someone please direct me to document how to add grep in or some guidance how to get this ps.sh script to works?</P> <P>thank you </P> Tue, 21 Aug 2018 20:01:17 GMT https://community.splunk.com/t5/Getting-Data-In/How-to-edit-ps-sh-to-limit-process-getting-in-ingest-for-Splunk/m-p/423101#M94215 tgmvt03 2018-08-21T20:01:17Z https://community.splunk.com/t5/Getting-Data-In/How-to-edit-ps-sh-to-limit-process-getting-in-ingest-for-Splunk/m-p/423102#M94216 <P>@tgmvt03 ,</P> <P>Depending on your OS version, you could add the list of commands (process names) to be displayed using <CODE>-C</CODE>. Grep will remove the headers also which is used in final output</P> <P>For e.g. for common Linux version, change the command </P> <P>from</P> <PRE><CODE>CMD='ps -wweo uname,pid,psr,pcpu,cputime,pmem,rsz,vsz,tty,s,etime,args' </CODE></PRE> <P>to</P> <PRE><CODE>CMD='ps -wwo uname,pid,psr,pcpu,cputime,pmem,rsz,vsz,tty,s,etime,args -C splunkd' </CODE></PRE> <P>Two main differences : </P> <UL> <LI>Removed <CODE>e</CODE> from the command which is for selecting all processes.</LI> <LI>Added <CODE>-C</CODE> with the command list - here for example <CODE>splunkd</CODE></LI> </UL> <P>Have a look at <A href="http://linuxcommand.org/lc3_man_pages/ps1.html">ps man page</A></P> Wed, 22 Aug 2018 03:44:47 GMT https://community.splunk.com/t5/Getting-Data-In/How-to-edit-ps-sh-to-limit-process-getting-in-ingest-for-Splunk/m-p/423102#M94216 renjith_nair 2018-08-22T03:44:47Z