Getting Data In

filtering process information

noliver
Engager

Hi,

I'm looking to get individual process performance data from Splunk, but only specific processes. (to reduce data)

What I have entered is:

[perfmon://Process]

index = main

object = Process

counters = Working Set - Private;Elapsed Time;% Processor Time;% UserTime

instances = process1;process2;process3

But it is still bringing back all process information for all processes. Does anyone know why its is not forwarding the data specified only?

Thanks

barbituate
Engager

I'm in the same boat. I'd like to have control over which process data is being gathered to conserve my license bandwidth. As it stands now, 10GB is being used by Perfmon :Process alone! I'm only interested in maybe 5 processes.

0 Karma

MuS
Legend

Hi noliver,

are you applying this props.conf on the universal forwarder or the indexer? It will not work on the forwarder, since it does not parse the data/events. You must apply it on the indexer or a heavy forwarder, they do data/event parsing.

Also, check that the name in the stanza is correct for this source type. Check the docs on route and filter data

hope this helps ...

cheers, MuS

0 Karma

mic1024
Path Finder

I think noliver is talking about the inputs.conf configuration rather than props.conf

Get Updates on the Splunk Community!

Splunk Observability Cloud's AI Assistant in Action Series: Auditing Compliance and ...

This is the third post in the Splunk Observability Cloud’s AI Assistant in Action series that digs into how to ...

Splunk Community Badges!

  Hey everyone! Ready to earn some serious bragging rights in the community? Along with our existing badges ...

What You Read The Most: Splunk Lantern’s Most Popular Articles!

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...