I recreated the index, the %_Processor_Time table basically shows 100s and then bunch of 0s. And nothing in between, for now, I hope. I'll come back to it tomorrow maybe there will be some diversity. 0 1,718 81.229% 100 282 13.333% 0.15612418354205651 4 0.189% 0.15594301259076812 3 0.142% 0.15594309209218249 3 0.142% 0.15600581901974953 3 0.142% 0.15607107435167317 3 0.142% 0.15613357457951121 3 0.142% 0.1561871657303206 3 0.142% 0.16447270967157646 ... View more

You can add perfmon monitoring by using either of those stanzas. Both are not required. The default sourcetype name should be "Perfmon:Process". Try searching the following to see if any events are being indexed: sourcetype="Perfmon:Process" Here is some additional information: http://docs.splunk.com/Documentation/Splunk/6.4.1/Data/MonitorWindowsperformance ... View more

if you're satisfied of the answer, please, accept the answer. Bye. Giuseppe ... View more

That looks about right but I can't seem to make it work. On each servers's universal forwarder I added this to \etc\system\local\wmi.conf: [WMI:SessionProcess] interval = 10 disabled = 0 index = perfmon_index wql = Select ProcessId, SessionId From Win32_Process And to \etc\system\local\inputs conf [perfmon://Process] interval = 10 object = Process counters = % Processor Time; ID Process; Working Set - Private; IO Read Operations/sec; IO Write Operations/sec instances = * index= perfmon_index disabled = 0 mode = multikv And restarted the UniversalForwarder service. It doesn't seem to forward any processes. Also in the samples inside the default wmi.conf and index.conf, the index is usually "perfmon" and not "perfmon_index". Which one should it be? Any ideas? Thanks! ... View more