Why is the processing missing data in Splunk_TA_NIX Process Monitoring?

[Spranta]

Hi, we are using the Splunk_TechnologyAdd-on(TA)_Linux(NIX) for process Monitoring.

Recently I noticed that not all processes are listed. For example when I'm running the ps.sh script from the splunk_ta_nix and count the lines ps.sh |wc -l I've got more than 500 Processes. But in Splunk, i'm only able to find exact 150 Processes. It's the same on every host.

So there are a lot of processes missing, I already opened a case about 3 weeks ago without any progress so far.

Does anyone have the same issue? Or has anyone an idea how to whitelist the only needed process information?

Thanks
Alex

[dpark1113]

I'm having the same issue here. Did you find the solution?

[Spranta]

Hi dpkar,
yes, you have to install the TA also on the Indexer, we missed that. Afterwards everthing works fine.

Just as hint, we found it very annoying that you can't filter which processes are really needed and you always have to index every single process. So we created another app which is filtering the really needed processes on the indexer and throw away any unneeded process information to keep down the license usage.

props.conf
[ps]
TRANSFORMS-psfilter = setnull,psfilter

[psfilter]
REGEX = .(process1|process2|process3 ....).
DEST_KEY = queue
FORMAT = indexQueue

[setnull]
REGEX = .
DEST_KEY = queue
FORMAT = nullQueue

and you have to add the following props within the Splunk_TA_nix
props.conf
[ps]
SHOULD_LINEMERGE = false
LINE_BREAKER = ([\r\n]+)
TRUNCATE=1000000
DATETIME_CONFIG = CURRENT
KV_MODE = none
PREAMBLE_REGEX = USER PID PSR pctCPU CPUTIME pctMEM RSZ_KB VSZ_KB TTY S ELAPSED COMMAND ARGS
EXTRACT-fields = (?\w+)\s+(?\d+)\s+(?[\w\?]+)\s+(?[\d.]+)\s+(?[\d.:-]+)\s+(?[\d.]+)\s+(?\d+)\s+(?\d+)\s+(?[\d\w\?\/]+)\s+(?\w+)\s+(?[\d:-]+)\s+(?[\w-.\d\/[]()]+)\s+(?.*)

Maybe thats usefull for you to
Best regards,
Alex

[dpark1113]

Thanks for you reply! I didn't expect to get response. 🙂

Indexer means, Splunk Enterprise Server? Sorry I'm new to Splunk.

[Spranta]

Depens on which role your instance is acting. We sepperate the workload, some Server are Searchheads and some are responsible only for Indexing the Data. You can have a Search- and Indexinginstance on one Hardware, but it's not recommanded.

https://docs.splunk.com/Documentation/Splunk/8.0.4/Overview/AboutSplunkEnterprisedeployments