topic Re: Searching the _introspection index, why are PerProcess events missing? in Splunk Search

Searching the _introspection index, why are PerProcess events missing?

dvmrp — Wed, 31 Aug 2016 16:55:19 GMT

Hi,

While checking the introspection index, the search index=_introspection | dedup component | table component returns below results, but 'PerProcess' is missing. Any idea?

Hostwide 
KVStoreServerStats 
KVStoreCollectionStats 
KVStoreReplicaSetStats 
IOStats 
Partitions 
Fishbucket 
Indexes 
Volumes 
Dispatch 
Summaries

Re: Searching the _introspection index, why are PerProcess events missing?

micahkemp — Wed, 31 Aug 2016 17:29:26 GMT

Do you get any results by searching:

index=_introspection "PerProcess"

And what timeframe are you searching (though I doubt that's the issue)?

Re: Searching the _introspection index, why are PerProcess events missing?

jbrodsky_splunk — Tue, 29 Sep 2020 11:03:53 GMT

Hi - sorry for the delay here. I think my understanding is that you're talking about a Windows Universal Forwarder, and you don't see the PerProcess component in the _introspection index. I checked a Windows forwarder in my lab (6.4.3, Windows 7 64 bit) and sure enough, even though the introspection app was enabled, I did NOT see PerProcess.

I did get this working, and here's what I did:

Copied server.conf within the introspection app from default to local.
Edited server.conf and set acquireExtra_i_data = true in two stanzas: [introspection:generator:disk_objects] and [introspection:generator:resource_usage]
Because I'm super impatient I set collectionPeriodInSecs = 60 in both stanzas.
Restarted forwarder.

A few minutes later, I had this, where I did not have that component ever before:

Try something like that and let us know? By the way, this is documented here:

https://docs.splunk.com/Documentation/Splunk/6.4.3/Troubleshooting/ConfigurePIF#Populate_.22Extra.22_fields