Splunk Search

Searching the _introspection index, why are PerProcess events missing?

dvmrp
New Member

Hi,

While checking the introspection index, the search index=_introspection | dedup component | table component returns below results, but 'PerProcess' is missing. Any idea?

Hostwide 
KVStoreServerStats 
KVStoreCollectionStats 
KVStoreReplicaSetStats 
IOStats 
Partitions 
Fishbucket 
Indexes 
Volumes 
Dispatch 
Summaries 
0 Karma

jbrodsky_splunk
Splunk Employee
Splunk Employee

Hi - sorry for the delay here. I think my understanding is that you're talking about a Windows Universal Forwarder, and you don't see the PerProcess component in the _introspection index. I checked a Windows forwarder in my lab (6.4.3, Windows 7 64 bit) and sure enough, even though the introspection app was enabled, I did NOT see PerProcess.

I did get this working, and here's what I did:

  1. Copied server.conf within the introspection app from default to local.
  2. Edited server.conf and set acquireExtra_i_data = true in two stanzas: [introspection:generator:disk_objects] and [introspection:generator:resource_usage]
  3. Because I'm super impatient I set collectionPeriodInSecs = 60 in both stanzas.
  4. Restarted forwarder.

A few minutes later, I had this, where I did not have that component ever before:

alt text

Try something like that and let us know? By the way, this is documented here:

https://docs.splunk.com/Documentation/Splunk/6.4.3/Troubleshooting/ConfigurePIF#Populate_.22Extra.22...

micahkemp
Champion

Do you get any results by searching:

index=_introspection "PerProcess"

And what timeframe are you searching (though I doubt that's the issue)?

0 Karma
Get Updates on the Splunk Community!

Splunk + ThousandEyes: Correlate frontend, app, and network data to troubleshoot ...

 Are you tired of troubleshooting delays caused by siloed frontend, application, and network data? We've got a ...

Splunk Observability for AI

Don’t miss out on an exciting Tech Talk on Splunk Observability for AI!Discover how Splunk’s agentic AI ...

🔐 Trust at Every Hop: How mTLS in Splunk Enterprise 10.0 Makes Security Simpler

From Idea to Implementation: Why Splunk Built mTLS into Splunk Enterprise 10.0  mTLS wasn’t just a checkbox ...