topic Re: How to view the current system process in Splunk Search

How to view the current system process

linker — Mon, 24 Mar 2014 07:41:26 GMT

hi,
in windows ,how to view the current system process by splunk?

kristian_kolb — Mon, 24 Mar 2014 10:46:45 GMT

Under windows, Splunk runs as two services;
- splunkd
- splunkweb

You can view them with the service control manager (services.msc) or task manager (taskmgr.exe)

richgalloway — Mon, 24 Mar 2014 12:18:02 GMT

In addition to what kristian.kolb said, entering the splunk status in a Command Prompt window will show you the Splunk process IDs (pid).

kristian_kolb — Mon, 24 Mar 2014 12:47:01 GMT

eeh yes.. I forgot the obvious 🙂

linker — Wed, 26 Mar 2014 03:46:45 GMT

not see splunk process, my meant is look at other windows process status by splunk?

username021 — Wed, 26 Mar 2014 04:08:54 GMT

You meant to setup Splunk to monitor Windows services.

in Windows , you would probabaly configure a universal forwarder i guess.

setup a wmi.conf in any of the apps under a local folder.

wmi.conf

[WMI:services]
disabled = 0
wql = Select * from Win32_services
index = you_index
interval = your_desired

linker — Wed, 26 Mar 2014 04:38:08 GMT

thanks, but my meant is setup Splunk to monitor other Windows current run process, for example in task manager see process

linu1988 — Wed, 26 Mar 2014 05:18:15 GMT

Several approach can be used.

wmi can be used as well as perfmon counters

[WMI:services] wql = select * from Win32_Process index = main interval = 60

[Perfmon//:Process] in inputs.conf object=Process Counters=* instances=* index = main interval = 60

Then you can query them. You can set perfmon , it will be easier.

index=main| table _time,IDprocess|dedup IDprocess

will give you latest processes running.

linker — Wed, 26 Mar 2014 09:55:06 GMT

Can see result table process cpu memory usage,for example In the task manager, see the process, user name, CPU, memory usage

linu1988 — Wed, 26 Mar 2014 17:50:27 GMT

you need to set up more options, but for a start

the above one will give you some details not the exact task manager.

karthikjacc — Mon, 12 Feb 2018 16:06:28 GMT

Inputs.conf Added the below line
[perfmon]
object=Process Counters=* instances=* index = main interval = 60

And search page used the query index=main| table _time,IDprocess|dedup IDprocess

not populate any result.