Getting Data In

Perfmon process elapsed time not showing individual instances

cn_jluke
New Member
Inputs.conf shows:
[perfmon://Process]
object = Process
interval = 120
counters = Elapsed Time
instances = w3wp*

Perfmon itself shows 6 instances of w3wp (w3wp, w3wp#1, w3wp#2, w3wp#3, w3wp#4, w3wp#5, w3wp#6)

Yet when you view the results in splunk (sourcetype="Perfmon:Process"), every Instance value is w3wp*.
I would expect it to list 6 entries each time period, one for each of the w3wp processes.

I can't tell whether it is averaging all w3wp processes or whether it is ignoring all the w3wp# instances (perhaps because the hashtag # is a comment symbol in config files?).

So thoughts on that?
Also, I would like to explicitly list each w3wp process in the inputs.conf as such.

instances = w3wp;w3wp#1;w3wp#2;w3wp#3;w3wp#4;w3wp#5;w3wp#6

However, # is a comment symbol so how do I escape the #?

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...