How to get a count from certain process on multiple machines?

[coldwolf7]

Hello,

So am trying to get a report of how many times in a month a certain process runs  on a machine and when the last it did

index=wss_desktop_perfmon sourcetype="wks:Perf_Process" instance!="_Total" instance!="idle" 
| where instance like "%bplus.wtk%"

So this is the start of the search. The process bplus.wtk in splunk can have multiple instances like 

bplus.wtk2#1

bplus.wtk2#2

bplus.wtk2#3

I do not care about the info past bplus.wtk I just want a count of how many times that shows up in month on a machine and count it

On that machine I want a report that looks like 

Computer	bplus.wtk	Last Time it Ran
workstation1	100	6/23/2023
workstation2	250	6/27/2023

I have tried Stats count and it is not working because I think it is a string value I am looking at and not a number value. 

Any help is appreciated

[coldwolf7]

That worked perfectly. I did take out the where statement and put the instance = "*xyz*" on the first line and took out the != and ran so much faster

[isoutamo · Accepted solution]

Hi

I think that something like this should work

index=wss_desktop_perfmon sourcetype="wks:Perf_Process" instance="*" instance!="_Total" instance!="idle" 
| where instance like "%bplus.wtk%"
| stats count as "bplus.wtk" max(_time) as lastRun by Computer
| eval lastRun = strftime(lastRun, "%m/%d/%Y")
| table Computer "bplus.wtk" lastRun

Usually you should add that instance = "*xyz*" on first line, but as you have wildcard also in the beginning on it, it could be better (in point of performance) to have it separately? You should check it by Job Inspector. Also check if those instance!=xyz are better to drop or not as you are selecting only some specific instances on second line. Splunk is not good for != and NOT (in performance point of view).

r. Ismo