Inputs.conf shows:
[perfmon://Process]
object = Process
interval = 120
counters = Elapsed Time
instances = w3wp*
Perfmon itself shows 6 instances of w3wp (w3wp, w3wp#1, w3wp#2, w3wp#3, w3wp#4, w3wp#5, w3wp#6)
Yet when you view the results in splunk (sourcetype="Perfmon:Process"), every Instance value is w3wp*.
I would expect it to list 6 entries each time period, one for each of the w3wp processes.
I can't tell whether it is averaging all w3wp processes or whether it is ignoring all the w3wp# instances (perhaps because the hashtag # is a comment symbol in config files?).
So thoughts on that?
Also, I would like to explicitly list each w3wp process in the inputs.conf as such.
instances = w3wp;w3wp#1;w3wp#2;w3wp#3;w3wp#4;w3wp#5;w3wp#6
However, # is a comment symbol so how do I escape the #?
