Searching the _introspection index, why are PerProcess events missing?

[dvmrp]

Hi,

While checking the introspection index, the search index=_introspection | dedup component | table component returns below results, but 'PerProcess' is missing. Any idea?

Hostwide 
KVStoreServerStats 
KVStoreCollectionStats 
KVStoreReplicaSetStats 
IOStats 
Partitions 
Fishbucket 
Indexes 
Volumes 
Dispatch 
Summaries 

[jbrodsky_splunk]

Hi - sorry for the delay here. I think my understanding is that you're talking about a Windows Universal Forwarder, and you don't see the PerProcess component in the _introspection index. I checked a Windows forwarder in my lab (6.4.3, Windows 7 64 bit) and sure enough, even though the introspection app was enabled, I did NOT see PerProcess.

I did get this working, and here's what I did:

1. Copied server.conf within the introspection app from default to local.
2. Edited server.conf and set acquireExtra_i_data = true in two stanzas: [introspection:generator:disk_objects] and [introspection:generator:resource_usage]
3. Because I'm super impatient I set collectionPeriodInSecs = 60 in both stanzas.
4. Restarted forwarder.

A few minutes later, I had this, where I did not have that component ever before:

Try something like that and let us know? By the way, this is documented here:

https://docs.splunk.com/Documentation/Splunk/6.4.3/Troubleshooting/ConfigurePIF#Populate_.22Extra.22...

[micahkemp]

Do you get any results by searching:

index=_introspection "PerProcess"

And what timeframe are you searching (though I doubt that's the issue)?