How to edit ps.sh to limit process getting in ingest for Splunk Add-on for Unix and Linux

[tgmvt03]

Hello,
I'm trying to only get a certain server processes to ingest to splunk index using Splunk Add-on for Unix and Linux script by editing the ps.sh script by adding grep command in there. like below.
However i'm getting error like
ERROR: Unsupported option (BSD syntax)
or
ERROR: Garbage option.

edit:
CMD='ps auxww|grep nc'

Could someone please direct me to document how to add grep in or some guidance how to get this ps.sh script to works?

thank you

[renjith_nair · Accepted solution]

@tgmvt03 ,

Depending on your OS version, you could add the list of commands (process names) to be displayed using -C. Grep will remove the headers also which is used in final output

For e.g. for common Linux version, change the command

from

CMD='ps -wweo uname,pid,psr,pcpu,cputime,pmem,rsz,vsz,tty,s,etime,args'

to

CMD='ps -wwo uname,pid,psr,pcpu,cputime,pmem,rsz,vsz,tty,s,etime,args -C splunkd'

Two main differences :

• Removed e from the command which is for selecting all processes.
• Added -C with the command list - here for example splunkd

Have a look at ps man page