Getting Data In

Why is the processing missing data in Splunk_TA_NIX Process Monitoring?

Spranta
Splunk Employee
Splunk Employee

Hi, we are using the Splunk_TechnologyAdd-on(TA)_Linux(NIX) for process Monitoring.

Recently I noticed that not all processes are listed. For example when I'm running the ps.sh script from the splunk_ta_nix and count the lines ps.sh |wc -l I've got more than 500 Processes. But in Splunk, i'm only able to find exact 150 Processes. It's the same on every host.

So there are a lot of processes missing, I already opened a case about 3 weeks ago without any progress so far.

Does anyone have the same issue? Or has anyone an idea how to whitelist the only needed process information?

Thanks
Alex

0 Karma

dpark1113
Explorer

I'm having the same issue here. Did you find the solution?

0 Karma

Spranta
Splunk Employee
Splunk Employee

Hi dpkar,
yes, you have to install the TA also on the Indexer, we missed that. Afterwards everthing works fine.

Just as hint, we found it very annoying that you can't filter which processes are really needed and you always have to index every single process. So we created another app which is filtering the really needed processes on the indexer and throw away any unneeded process information to keep down the license usage.

props.conf
[ps]
TRANSFORMS-psfilter = setnull,psfilter

[psfilter]
REGEX = .(process1|process2|process3 ....).
DEST_KEY = queue
FORMAT = indexQueue

[setnull]
REGEX = .
DEST_KEY = queue
FORMAT = nullQueue

and you have to add the following props within the Splunk_TA_nix
props.conf
[ps]
SHOULD_LINEMERGE = false
LINE_BREAKER = ([\r\n]+)
TRUNCATE=1000000
DATETIME_CONFIG = CURRENT
KV_MODE = none
PREAMBLE_REGEX = USER PID PSR pctCPU CPUTIME pctMEM RSZ_KB VSZ_KB TTY S ELAPSED COMMAND ARGS
EXTRACT-fields = (?\w+)\s+(?\d+)\s+(?[\w\?]+)\s+(?[\d.]+)\s+(?[\d.:-]+)\s+(?[\d.]+)\s+(?\d+)\s+(?\d+)\s+(?[\d\w\?\/]+)\s+(?\w+)\s+(?[\d:-]+)\s+(?[\w-.\d\/[]()]+)\s+(?.*)

Maybe thats usefull for you to
Best regards,
Alex

0 Karma

dpark1113
Explorer

Thanks for you reply! I didn't expect to get response. 🙂

Indexer means, Splunk Enterprise Server? Sorry I'm new to Splunk.

0 Karma

Spranta
Splunk Employee
Splunk Employee

Depens on which role your instance is acting. We sepperate the workload, some Server are Searchheads and some are responsible only for Indexing the Data. You can have a Search- and Indexinginstance on one Hardware, but it's not recommanded.

https://docs.splunk.com/Documentation/Splunk/8.0.4/Overview/AboutSplunkEnterprisedeployments

0 Karma
Get Updates on the Splunk Community!

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...