Hi - sorry for the delay here. I think my understanding is that you're talking about a Windows Universal Forwarder, and you don't see the PerProcess component in the _introspection index. I checked a Windows forwarder in my lab (6.4.3, Windows 7 64 bit) and sure enough, even though the introspection app was enabled, I did NOT see PerProcess.
I did get this working, and here's what I did:
Copied server.conf within the introspection app from default to local.
Edited server.conf and set acquireExtra_i_data = true in two stanzas: [introspection:generator:disk_objects] and [introspection:generator:resource_usage]
Because I'm super impatient I set collectionPeriodInSecs = 60 in both stanzas.
Restarted forwarder.
A few minutes later, I had this, where I did not have that component ever before:
Try something like that and let us know? By the way, this is documented here:
https://docs.splunk.com/Documentation/Splunk/6.4.3/Troubleshooting/ConfigurePIF#Populate_.22Extra.22_fields
... View more