I presume you are seeing the known issue with perfmon process CPU collection. There is a specific page which covers this in the docs - https://docs.splunk.com/Documentation/Splunk/7.3.0/ReleaseNotes/WorkaroundforPerformanceDataHelperAPIWindowswindowsmulticore
It looks like a workaround was added to v7.3 and above by using the useWinApiProcStats option. However this does not look like a permanent fix, just a workaround for some people. You would need to test if this works for your environment.
The other options are to use other sources for perfmon data rather than using Splunk modular inputs - for example use a powershell script to collect the data and read the output, or run perfmon in CSV collection mode and read the output files. None of ideal and will all need work to get up and running.
... View more
I have a gui running as javaw.exe and I want to identify when this gui is "Not Responding"
I am using the following command to identify it:
tasklist /v | findstr javaw.exe
What is working:
- Running this command from command prompt
- Adding this command to a .bat and running that from command prompt
What is not working:
- Using input.conf to run the script (it executes and indexes the result, but the "Status" is "Unknown" instead of "Running")
What I have tried:
- I have looked at permissions and my user and "System" all have adequate permissions (For the .bat, it's parent folders)
- I have tried adjusting the SplunkForwarder Service to run as my user instead of System
-- It is noteworthy, after running the service as my user, if I run a tasklist command and look up splunk, it still doesn't know what user is running the service
Has anyone run into this? Anyone have any advice on how to fix it? Is there a better way to look for a hanging window/process with Splunk?
... View more