I am using the Universal Forwarder to collect information on a Java Process. When monitoring "% Processor Time" for a specific process, I noticed a discrepancy between the results from Performance Monitor vs. Resource Monitor for this process when pulling the information using default values (below is my input.conf value):
object = Process
counters = % Processor Time;Working Set;Working Set Peak;
instances = _Total;java;javaw
interval = 10
It seems to be corrected when I scale % Processor Time down to 10% of the default value when building my splunk search (shown below):
host="" (counter="% Processor Time" AND instance=java OR instance=javaw) OR (collection="CPU Load" AND instance=_Total)
| timechart span=20s avg(Value) AS "CPU Utilization" by instance
| eval java=java/10
| eval javaw=javaw/10
| rename java as "Appserver CPU" javaw as "Client CPU" VALUE_Total as "Total Machine CPU"
I thought this fixed the issue until we actually get a spike in CPU and I noticed the java and javaw values now max out at 10% and wont go any higher.
I know it is supposed to max out at 100% and I scaled it down to 10% of the normal value, that makes sense to me but if it really is maxing out there, why can't I get the real values sent to the indexer from perfmon in the first place.
Any help would be much appreciated. Thanks!
... View more
I have a gui running as javaw.exe and I want to identify when this gui is "Not Responding"
I am using the following command to identify it:
tasklist /v | findstr javaw.exe
What is working:
- Running this command from command prompt
- Adding this command to a .bat and running that from command prompt
What is not working:
- Using input.conf to run the script (it executes and indexes the result, but the "Status" is "Unknown" instead of "Running")
What I have tried:
- I have looked at permissions and my user and "System" all have adequate permissions (For the .bat, it's parent folders)
- I have tried adjusting the SplunkForwarder Service to run as my user instead of System
-- It is noteworthy, after running the service as my user, if I run a tasklist command and look up splunk, it still doesn't know what user is running the service
Has anyone run into this? Anyone have any advice on how to fix it? Is there a better way to look for a hanging window/process with Splunk?
... View more