- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
this SoS can not run on windows Splunk server, right? no warning on this issue, my resource usage report wrong ps, there no ps in windows splunk index
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content


The SoS app absolutely will run on a Windows search-head and/or indexer. In order to enable resource usage monitoring for Splunk processes on Windows, you'll need to enable the ps_sos.ps1
powershell-based scripted input. Please consult the app README file or the in-view help for the "Splunk CPU/Memory Usage" view for details.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content


The SoS app absolutely will run on a Windows search-head and/or indexer. In order to enable resource usage monitoring for Splunk processes on Windows, you'll need to enable the ps_sos.ps1
powershell-based scripted input. Please consult the app README file or the in-view help for the "Splunk CPU/Memory Usage" view for details.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content

This script provides ps like output which can be useful in troubleshooting memory/CPU type issues..and is different from the data you'd get from WMI as it'll be used to populate graphs within the SOS app, which won't happen with WMI data.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
I have a follow up question here !
Say, we are already getting WMI metrics from Splunk for the search-head.
What does this script do/provide that the out-of-the-box monitoring that comes with Splunk does not ?
