How to exclude or filter 0% window process from hostmetrics - process?

[fongpen]

Hi Guru, 

How do we exclude 0% process usage from Hostmetrics? We would like to capture those process have >0% usage only..

Appreciate if you can provide the sample. 

hostmetrics:
collection_interval: 10s
scrapers:
# System processes metrics, disabled by default
process:    (filter / exclude 0% process usage)

[fongpen · Accepted solution]

Replied from Splunk Support :  unfortunately, it looks like it's not possible to exclude process metrics which have 0% value

[fongpen]

Samples: -

Include : * Process > 0% 

Exclude : * Process = 0% 

[ITWhisperer]

These appear to be screenshots - Splunk doesn't ingest these very well.

[fongpen]

I would like to have something like this:-

PS > Get-Counter '\Process(*)\% Processor Time' -ErrorAction SilentlyContinue | Select-Object -ExpandProperty CounterSamples | Sort-Object -Property cookedvalue -Descending | Where-Object CookedValue -gt 0

*** There are thousand of 0% process which wasted a lot of space and custom metrics license. 

[ITWhisperer]

Please provide some sample raw events that you are trying to ingest, both the ones you want to keep and the one you want to exclude.

[ITWhisperer]

Please can you provide some sanitised events  so we can see what you are dealing with?