All Apps and Add-ons

Why does running ps.sh and ps from the host show more data than running a search in Splunk?

banderson7
Communicator

Running the search hostname=hostname index=os source=ps doesn't show all the information that running ps.sh from the host shows. For example, I don't see my Java command. Can someone help w/ this?

0 Karma

woodcock
Esteemed Legend

The command will run on the Forwarder as the user that owns/runs the splunkd process. That user may not be privileged enough to show everything. See about giving sudo to that user and running the ps as root with sudo.

0 Karma

banderson7
Communicator

That's not it unfortunately. Splunk runs as the splunk user on the server, and when I login to the server as that user and run ps, I get all the data I expect.

0 Karma

pkeller
Contributor

This sounds like you might be getting truncated after 256 events (the default). If that's the case, you could update props.conf for the 'ps' sourcetype with TRUNCATE = 0.

Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...