filtering process information

[noliver]

Hi,

I'm looking to get individual process performance data from Splunk, but only specific processes. (to reduce data)

What I have entered is:

[perfmon://Process]

index = main

object = Process

counters = Working Set - Private;Elapsed Time;% Processor Time;% UserTime

instances = process1;process2;process3

But it is still bringing back all process information for all processes. Does anyone know why its is not forwarding the data specified only?

Thanks

[barbituate]

I'm in the same boat. I'd like to have control over which process data is being gathered to conserve my license bandwidth. As it stands now, 10GB is being used by Perfmon :Process alone! I'm only interested in maybe 5 processes.

[MuS]

Hi noliver,

are you applying this props.conf on the universal forwarder or the indexer? It will not work on the forwarder, since it does not parse the data/events. You must apply it on the indexer or a heavy forwarder, they do data/event parsing.

Also, check that the name in the stanza is correct for this source type. Check the docs on route and filter data

hope this helps ...

cheers, MuS

[mic1024]

I think noliver is talking about the inputs.conf configuration rather than props.conf