SoS cannot run on windows Splunk server?

[hadirs]

this SoS can not run on windows Splunk server, right? no warning on this issue, my resource usage report wrong ps, there no ps in windows splunk index

[hexx · Accepted solution]

The SoS app absolutely will run on a Windows search-head and/or indexer. In order to enable resource usage monitoring for Splunk processes on Windows, you'll need to enable the ps_sos.ps1 powershell-based scripted input. Please consult the app README file or the in-view help for the "Splunk CPU/Memory Usage" view for details.

[jbsplunk]

This script provides ps like output which can be useful in troubleshooting memory/CPU type issues..and is different from the data you'd get from WMI as it'll be used to populate graphs within the SOS app, which won't happen with WMI data.

[asarolkar]

I have a follow up question here !

Say, we are already getting WMI metrics from Splunk for the search-head.

What does this script do/provide that the out-of-the-box monitoring that comes with Splunk does not ?