Getting Data In

WMI Input: best practice for field values with spaces

feichinger
Path Finder

I have some powershell scripts scheduled on a windows server and want to track their memory and cpu utilization. And I do have a working solution, but I just wondered what's the best practice here.

So I created a WMI input for Win32_process, which has the "CommandLine" for each powershell.exe instance, and that includes the script name.

But out of the box, Splunk cuts off that CommandLine field at the first space.

feichinger_0-1600157286972.png

I guess my question is, if there are any props.conf options (or in any other configuration) to let it read that full "line" and not stop at the spaces. It seems to be clever enough to read the WMI feed in a way where it puts each field=value into one line in the _raw data.

The server in question has a universal forwarder installed. And that has an app with the wmi.conf in it:

[WMI:powershell.exe]
index = perfmon
disabled = 0
interval = 60
wql = SELECT CommandLine, ProcessId, WorkingSetSize, KernelModeTime, UserModeTime from Win32_process WHERE Name = 'powershell.exe'

And on the indexer, the sourcetype is configured in the props.conf like this:

[WMI:powershell.exe]
FIELDALIAS-dest_for_perfmon = host AS dest
FIELDALIAS-src_for_perfmon = host AS src
LINE_BREAKER = ([\r\n]+)
NO_BINARY_CHECK = true
category = Custom
disabled = false

In the end, my goal is to get that script name, so I just added a field extraction for that

EXTRACT-ScriptName = CommandLine=powershell.exe+\s+\-command+\s+"&\s+'*(?P<ScriptName>[^("|')]+)

Is that the best way of doing it?

Labels (2)
0 Karma
1 Solution

thambisetty
SplunkTrust
SplunkTrust

what you have done to extract CommandLine is correct but EXTRACT is search time field extraction so you can keep it on search head rather Indexers.

[WMI:powershell.exe]
EXTRACT-ScriptName = CommandLine=powershell.exe+\s+\-command+\s+"&\s+'*(?P<ScriptName>[^("|')]+)

 

————————————
If this helps, give a like below.

View solution in original post

0 Karma

feichinger
Path Finder

good to know, thanks

0 Karma

thambisetty
SplunkTrust
SplunkTrust

what you have done to extract CommandLine is correct but EXTRACT is search time field extraction so you can keep it on search head rather Indexers.

[WMI:powershell.exe]
EXTRACT-ScriptName = CommandLine=powershell.exe+\s+\-command+\s+"&\s+'*(?P<ScriptName>[^("|')]+)

 

————————————
If this helps, give a like below.
0 Karma
Get Updates on the Splunk Community!

Stay Connected: Your Guide to July Tech Talks, Office Hours, and Webinars!

What are Community Office Hours?Community Office Hours is an interactive 60-minute Zoom series where ...

Updated Data Type Articles, Anniversary Celebrations, and More on Splunk Lantern

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...

A Prelude to .conf25: Your Guide to Splunk University

Heading to Boston this September for .conf25? Get a jumpstart by arriving a few days early for Splunk ...