Splunk won't index Perfmon Process object

[gregbo]

I have splunk getting data for the other objects, including Processor, but nothing happens for Process.

The process stanza:

[perfmon://Process]
interval = 60
object = Process
counters = _Total
instances = *
index = windows
showZeroValue = 1
disabled = 0

The processor stanza:

[perfmon://Proccesor]
interval = 60
object = Processor
counters = *
instances = *
index = windows
showZeroValue = 1

[amitm05]

@gregbo
Couple of queries - Can you mention where are you trying to get the perfmon data from ? Is this from local Splunk instance Or forwarder based ? To which user are you setting the permission ?

[skalliger]

Is that correct what you wrote? Because "Process" is written correct, the "Proccesor" stanza however isn't. Does the user have all required permissions?

[gregbo]

There's a Process object and a Processor object in Perfmon. The Processor object works fine. The user has all the necessary rights.

[skalliger]

Then I can only suggest to file a support case and get some troubleshooting steps. I'm no Windows expert. 😕

Skalli