Getting Data In

Splunk won't index Perfmon Process object

gregbo
Communicator

I have splunk getting data for the other objects, including Processor, but nothing happens for Process.

The process stanza:

[perfmon://Process]
interval = 60
object = Process
counters = _Total
instances = *
index = windows
showZeroValue = 1
disabled = 0

The processor stanza:

[perfmon://Proccesor]
interval = 60
object = Processor
counters = *
instances = *
index = windows
showZeroValue = 1
0 Karma

amitm05
Builder

@gregbo
Couple of queries - Can you mention where are you trying to get the perfmon data from ? Is this from local Splunk instance Or forwarder based ? To which user are you setting the permission ?

0 Karma

skalliger
SplunkTrust
SplunkTrust

Is that correct what you wrote? Because "Process" is written correct, the "Proccesor" stanza however isn't. Does the user have all required permissions?

0 Karma

gregbo
Communicator

There's a Process object and a Processor object in Perfmon. The Processor object works fine. The user has all the necessary rights.

0 Karma

skalliger
SplunkTrust
SplunkTrust

Then I can only suggest to file a support case and get some troubleshooting steps. I'm no Windows expert. 😕

Skalli

0 Karma
Get Updates on the Splunk Community!

Maximize the Value from Microsoft Defender with Splunk

<P style=" text-align: center; "><span class="lia-inline-image-display-wrapper lia-image-align-center" ...

This Week's Community Digest - Splunk Community Happenings [6.27.22]

<FONT size="5"><FONT size="5" color="#FF00FF">Get the latest news and updates from the Splunk Community ...