Finding the top 10 or 15 processes in taskmgr search query.

[saccam447]

Hey folks. Im new to splunk ive been created a bunch of different useful dashboards but i could not figure out how to do the following:

top 10 or 15 processes within task mgr.

I already have my perfmon.conf configured to forward a bunch of counters already. are there any counters in particular that I would need to help with this search query?

thank you very much for you input.

Scott

[saccam447 · Accepted solution]

This is what I did below: I also made sure that my perfmon.conf file had all of the necessary instances and counters for the perfmon counter i created below.

source="perfmon:process percent processor time" host="las-p-pd-sql*" instance= * | chart max(Value) as MaxCPU, by instance,host

This worked perfectly for what I needed. The Chart and Table is very useful to look for a spike.

But Thank you Takajian for your help.

[Takajian]

Do you want to see statistics of process on Windows server? If so, you can install Windows app. This may be the easiest way to do. The site is following.

http://splunk-base.splunk.com/apps/22315/splunk-for-windows

Following command will show you max cpu load by process name. Hope this help.

source=WMI:localprocesses Name!=Total | rex field=Name "(?[^#]+)#\d+$" | eval CPULoad = PercentProcessorTime | stats avg(CPULoad) by Name

[saccam447]

I already have the Windows app installed. The problem is that im using perfmon:* instead of WMI:* for all my counters. Is there a way where that seatrch query can be modified for perfmon:* ... ? Or is WMI easier for this type of query?

Hope I am making sense.

Scott