How to view the current system process

[linker]

hi,
in windows ,how to view the current system process by splunk?

[linu1988]

you need to set up more options, but for a start

the above one will give you some details not the exact task manager.

[linker]

Can see result table process cpu memory usage,for example In the task manager, see the process, user name, CPU, memory usage

[linu1988]

Several approach can be used.

wmi can be used as well as perfmon counters

[WMI:services]
wql = select * from Win32_Process
index = main
interval = 60

OR

[Perfmon//:Process] in inputs.conf
object=Process
Counters=*
instances=*
index = main
interval = 60

Then you can query them. You can set perfmon , it will be easier.

index=main| table _time,IDprocess|dedup IDprocess

will give you latest processes running.

[karthikjacc]

Inputs.conf Added the below line
[perfmon]
object=Process Counters=* instances=* index = main interval = 60

And search page used the query index=main| table _time,IDprocess|dedup IDprocess

not populate any result.

[linker]

thanks, but my meant is setup Splunk to monitor other Windows current run process, for example in task manager see process

[username021]

You meant to setup Splunk to monitor Windows services.

in Windows , you would probabaly configure a universal forwarder i guess.

setup a wmi.conf in any of the apps under a local folder.

wmi.conf

[WMI:services]
disabled = 0
wql = Select * from Win32_services
index = you_index
interval = your_desired

[linker]

not see splunk process, my meant is look at other windows process status by splunk?

[richgalloway]

In addition to what kristian.kolb said, entering the splunk status in a Command Prompt window will show you the Splunk process IDs (pid).

[kristian_kolb]

eeh yes.. I forgot the obvious 🙂

/K

[kristian_kolb]

Under windows, Splunk runs as two services;
- splunkd
- splunkweb

You can view them with the service control manager (services.msc) or task manager (taskmgr.exe)