topic Re: monitor performance counter for a specific process in Monitoring Splunk

monitor performance counter for a specific process

barsuk1 — Sun, 27 Nov 2011 15:11:43 GMT

Hi,
Is there a way to do the subj. , i.e. to monitor performance counter of a specific process on Windows? Let's say I have some service process running on windows. I can add performance counter to it on Windows perfmon for example for the Processor Usage % (or whatever is available on Windows). However on Splunk "Local Performance Monitoring" I see only the system wide preformance counters?

Re: monitor performance counter for a specific process

MHibbin — Sun, 27 Nov 2011 17:44:20 GMT

have you tried writing a custom script which outputs the data you require to stdout (or to a log file if you prefer)... and then add it as a scripted input for Splunk (of get Splunk to monitor the file you created with you custom script).

Re: monitor performance counter for a specific process

barsuk1 — Mon, 28 Nov 2011 08:01:28 GMT

no I did not try, but I guess it is possible. however my question was if Splunk knows how to look at this counters by itself... so the answer here is probably NO?

Re: monitor performance counter for a specific process

Ayn — Mon, 28 Nov 2011 08:20:33 GMT

Not out of the box, no.

Re: monitor performance counter for a specific process

dguimbellot2019 — Tue, 26 Mar 2019 14:15:42 GMT

i updated the wmi.conf to include this
[WMI:ProcessPath]
interval = 60
disabled = 0
index = default
wql = select Path, ProcessId from Win32_Process where Name like 'foobar%'