Getting Data In

filtering process information



I'm looking to get individual process performance data from Splunk, but only specific processes. (to reduce data)

What I have entered is:


index = main

object = Process

counters = Working Set - Private;Elapsed Time;% Processor Time;% UserTime

instances = process1;process2;process3

But it is still bringing back all process information for all processes. Does anyone know why its is not forwarding the data specified only?



I'm in the same boat. I'd like to have control over which process data is being gathered to conserve my license bandwidth. As it stands now, 10GB is being used by Perfmon :Process alone! I'm only interested in maybe 5 processes.

0 Karma


Hi noliver,

are you applying this props.conf on the universal forwarder or the indexer? It will not work on the forwarder, since it does not parse the data/events. You must apply it on the indexer or a heavy forwarder, they do data/event parsing.

Also, check that the name in the stanza is correct for this source type. Check the docs on route and filter data

hope this helps ...

cheers, MuS

0 Karma

Path Finder

I think noliver is talking about the inputs.conf configuration rather than props.conf