Splunk Enterprise

Finding the top 10 or 15 processes in taskmgr search query.

saccam447
Explorer

Hey folks. Im new to splunk ive been created a bunch of different useful dashboards but i could not figure out how to do the following:

top 10 or 15 processes within task mgr.

I already have my perfmon.conf configured to forward a bunch of counters already. are there any counters in particular that I would need to help with this search query?

thank you very much for you input.

Scott

0 Karma
1 Solution

saccam447
Explorer

This is what I did below: I also made sure that my perfmon.conf file had all of the necessary instances and counters for the perfmon counter i created below.

source="perfmon:process percent processor time" host="las-p-pd-sql*" instance= * | chart max(Value) as MaxCPU, by instance,host

This worked perfectly for what I needed. The Chart and Table is very useful to look for a spike.

But Thank you Takajian for your help.

View solution in original post

0 Karma

saccam447
Explorer

This is what I did below: I also made sure that my perfmon.conf file had all of the necessary instances and counters for the perfmon counter i created below.

source="perfmon:process percent processor time" host="las-p-pd-sql*" instance= * | chart max(Value) as MaxCPU, by instance,host

This worked perfectly for what I needed. The Chart and Table is very useful to look for a spike.

But Thank you Takajian for your help.

0 Karma

Takajian
Builder

Do you want to see statistics of process on Windows server? If so, you can install Windows app. This may be the easiest way to do. The site is following.

http://splunk-base.splunk.com/apps/22315/splunk-for-windows

Following command will show you max cpu load by process name. Hope this help.

source=WMI:localprocesses Name!=Total | rex field=Name "(?[^#]+)#\d+$" | eval CPULoad = PercentProcessorTime | stats avg(CPULoad) by Name

0 Karma

saccam447
Explorer

I already have the Windows app installed. The problem is that im using perfmon:* instead of WMI:* for all my counters. Is there a way where that seatrch query can be modified for perfmon:* ... ? Or is WMI easier for this type of query?

Hope I am making sense.

Scott

0 Karma
Get Updates on the Splunk Community!

Routing Data to Different Splunk Indexes in the OpenTelemetry Collector

This blog post is part of an ongoing series on OpenTelemetry. The OpenTelemetry project is the second largest ...

Getting Started with AIOps: Event Correlation Basics and Alert Storm Detection in ...

Getting Started with AIOps:Event Correlation Basics and Alert Storm Detection in Splunk IT Service ...

Register to Attend BSides SPL 2022 - It's all Happening October 18!

Join like-minded individuals for technical sessions on everything Splunk!  This is a community-led and run ...