Getting Data In

Why is the processing missing data in Splunk_TA_NIX Process Monitoring?

Spranta
Splunk Employee
Splunk Employee

Hi, we are using the Splunk_TechnologyAdd-on(TA)_Linux(NIX) for process Monitoring.

Recently I noticed that not all processes are listed. For example when I'm running the ps.sh script from the splunk_ta_nix and count the lines ps.sh |wc -l I've got more than 500 Processes. But in Splunk, i'm only able to find exact 150 Processes. It's the same on every host.

So there are a lot of processes missing, I already opened a case about 3 weeks ago without any progress so far.

Does anyone have the same issue? Or has anyone an idea how to whitelist the only needed process information?

Thanks
Alex

0 Karma

dpark1113
Explorer

I'm having the same issue here. Did you find the solution?

0 Karma

Spranta
Splunk Employee
Splunk Employee

Hi dpkar,
yes, you have to install the TA also on the Indexer, we missed that. Afterwards everthing works fine.

Just as hint, we found it very annoying that you can't filter which processes are really needed and you always have to index every single process. So we created another app which is filtering the really needed processes on the indexer and throw away any unneeded process information to keep down the license usage.

props.conf
[ps]
TRANSFORMS-psfilter = setnull,psfilter

[psfilter]
REGEX = .(process1|process2|process3 ....).
DEST_KEY = queue
FORMAT = indexQueue

[setnull]
REGEX = .
DEST_KEY = queue
FORMAT = nullQueue

and you have to add the following props within the Splunk_TA_nix
props.conf
[ps]
SHOULD_LINEMERGE = false
LINE_BREAKER = ([\r\n]+)
TRUNCATE=1000000
DATETIME_CONFIG = CURRENT
KV_MODE = none
PREAMBLE_REGEX = USER PID PSR pctCPU CPUTIME pctMEM RSZ_KB VSZ_KB TTY S ELAPSED COMMAND ARGS
EXTRACT-fields = (?\w+)\s+(?\d+)\s+(?[\w\?]+)\s+(?[\d.]+)\s+(?[\d.:-]+)\s+(?[\d.]+)\s+(?\d+)\s+(?\d+)\s+(?[\d\w\?\/]+)\s+(?\w+)\s+(?[\d:-]+)\s+(?[\w-.\d\/[]()]+)\s+(?.*)

Maybe thats usefull for you to
Best regards,
Alex

0 Karma

dpark1113
Explorer

Thanks for you reply! I didn't expect to get response. 🙂

Indexer means, Splunk Enterprise Server? Sorry I'm new to Splunk.

0 Karma

Spranta
Splunk Employee
Splunk Employee

Depens on which role your instance is acting. We sepperate the workload, some Server are Searchheads and some are responsible only for Indexing the Data. You can have a Search- and Indexinginstance on one Hardware, but it's not recommanded.

https://docs.splunk.com/Documentation/Splunk/8.0.4/Overview/AboutSplunkEnterprisedeployments

0 Karma
Get Updates on the Splunk Community!

Deep Dive into Federated Analytics: Unlocking the Full Power of Your Security Data

In today’s complex digital landscape, security teams face increasing pressure to protect sprawling data across ...

Your summer travels continue with new course releases

Summer in the Northern hemisphere is in full swing, and is often a time to travel and explore. If your summer ...

From Alert to Resolution: How Splunk Observability Helps SREs Navigate Critical ...

It's 3:17 AM, and your phone buzzes with an urgent alert. Wire transfer processing times have spiked, and ...