I'm looking to get individual process performance data from Splunk, but only specific processes. (to reduce data)
What I have entered is:
index = main
object = Process
counters = Working Set - Private;Elapsed Time;% Processor Time;% UserTime
instances = process1;process2;process3
But it is still bringing back all process information for all processes. Does anyone know why its is not forwarding the data specified only?
I'm in the same boat. I'd like to have control over which process data is being gathered to conserve my license bandwidth. As it stands now, 10GB is being used by Perfmon :Process alone! I'm only interested in maybe 5 processes.
are you applying this props.conf on the universal forwarder or the indexer? It will not work on the forwarder, since it does not parse the data/events. You must apply it on the indexer or a heavy forwarder, they do data/event parsing.
Also, check that the name in the stanza is correct for this source type. Check the docs on route and filter data
hope this helps ...