Getting Data In

Splunk won't index Perfmon Process object

gregbo
Communicator

I have splunk getting data for the other objects, including Processor, but nothing happens for Process.

The process stanza:

[perfmon://Process]
interval = 60
object = Process
counters = _Total
instances = *
index = windows
showZeroValue = 1
disabled = 0

The processor stanza:

[perfmon://Proccesor]
interval = 60
object = Processor
counters = *
instances = *
index = windows
showZeroValue = 1
0 Karma

amitm05
Builder

@gregbo
Couple of queries - Can you mention where are you trying to get the perfmon data from ? Is this from local Splunk instance Or forwarder based ? To which user are you setting the permission ?

0 Karma

skalliger
Motivator

Is that correct what you wrote? Because "Process" is written correct, the "Proccesor" stanza however isn't. Does the user have all required permissions?

0 Karma

gregbo
Communicator

There's a Process object and a Processor object in Perfmon. The Processor object works fine. The user has all the necessary rights.

0 Karma

skalliger
Motivator

Then I can only suggest to file a support case and get some troubleshooting steps. I'm no Windows expert. 😕

Skalli

0 Karma
Get Updates on the Splunk Community!

Optimize Cloud Monitoring

  TECH TALKS Optimize Cloud Monitoring Tuesday, August 13, 2024  |  11:00AM–12:00PM PST   Register to ...

What's New in Splunk Cloud Platform 9.2.2403?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.2.2403! Analysts can ...

Stay Connected: Your Guide to July and August Tech Talks, Office Hours, and Webinars!

Dive into our sizzling summer lineup for July and August Community Office Hours and Tech Talks. Scroll down to ...