Process Detail

uberAgent collects metric per application/process like user and domain, CPU usage, RAM usage as well as network latency and throughput.

Note: processes are auto-grouped into applications, i.e. the application name is determined automatically without requiring any configuration. Information on how this works is available here.

Details

• Source type: uberAgent:Process:ProcessDetail
• Used in dashboards: Process Performance, Application Performance, Machine Performance, Application Usage, Process GPU, Single Machine Detail, Single Application Detail, Single User Detail, Analyze data over time
• Enabled through configuration setting: ProcessDetailTop5 or ProcessDetailFull
• Related configuration settings: [ProcessToApplicationMapping], [ApplicationMappingIgnoredProcesses], [ProcessDetailFull_Filter], [ProcessDetail_SendCommandline], [ProcessStartupSettings]

List of Fields in the Raw Agent Data

Field	Description	Data type	Unit	Example
ProcName	Process name	String		chrome.exe
ProcCPUTimeMs	Process CPU time	Number	ms	5000
ProcCPUPercent	Process CPU usage	Number	%	12
ProcIOPSRead	Process I/O read operations	Number		200
ProcIOPSWrite	Process I/O write operations	Number		200
ProcIOReadCount	Count of process I/O read operations	Number		100
ProcIOWriteCount	Count of process I/O write operations	Number		100
ProcIOReadMB	Amount of process I/O read operations data volume	Number	MB	150
ProcIOWriteMB	Amount of process I/O write operations data volume	Number	MB	150
ProcIOLatencyReadMs	Process I/O read operations latency	Number	ms	300
ProcIOLatencyWriteMs	Process I/O write operations latency	Number	ms	300
ProcWorkingSetMB	Process consumed RAM	Number	MB	100
ProcNetKBPS	Process generated network traffic	Number	KB	500
ProcUser	Process user	String		Domain\JohnDoe
ProcGpuComputePercent	Process GPU compute usage	Number	%	20
ProcGpuMemMB	Process GPU memory usage	Number	MB	150
AppId	Associated application ID. Used by uberAgent to lookup application names and populate field AppName.	String		GglChrm
AppVersion	Application version	String		67.0.3396.99
ProcID	Process ID	Number		456
ProcCmdline	Full commandline the process was launched with	String		C:\Program Files (x86)\Google\Chrome\Application\chrome.exe –url http://vastlimits.com
ProcGUID	Unique identifier that is generated by uberAgent when the process is started	String		00000000-ebe5-469c-63ae-f5a1de28d401
ProcGpuEngineMostUsed	The number of the most used GPU engine (requires Windows 10 1709)	Number		1
ProcGpuEngineMostUsedDisplayName	The display name of the most used GPU engine (requires Windows 10 1709)	String		3D

The following field is empty unless EnableExtendedInfo is set to true: ProcGUID

The following field is empty unless EnableExtendedInfo and [ProcessDetail_SendCommandline] are configured: ProcCmdline

List of Calculated Fields

Field	Description	Data type	Unit	Example	Where available
ProcCPUTimeS	Process CPU time	Number	s	5	Splunk data model
ProcIOCount	ProcIOReadCount + ProcIOWriteCount	String		200	Splunk data model
ProcIOPS	ProcIOPSRead + ProcIOPSWrite	Number		400	Splunk data model
ProcIOMB	ProcIOReadMB + ProcIOWriteMB	Number	MB	300	Splunk data model
ProcIOMBPS	ProcIOMB / ProcIOCount x ProcIOPS	Number	MB	600	Splunk data model
ProcIOLatencyMs	ProcIOLatencyReadMs + ProcIOLatencyWriteMs	Number	ms	600	Splunk data model
ProcIODurationReadMS	ProcIOLatencyMsRead x ProcIOCountRead	Number	ms	30000	Splunk data model
ProcIODurationWriteMS	ProcIOLatencyMsWrite x ProcIOCountWrite	Number	ms	30000	Splunk data model
ProcIODurationMS	ProcIODurationReadMS + ProcIODurationWriteMS	Number	ms	60000	Splunk data model
User	Content of field ProcUser	String		Domain\JohnDoe	Splunk data model
AppName	Associated application name	String		Google Chrome	Splunk data model, Splunk SPL
time	Content of field _time	Number		2018-07-31T18:34:32.451+02:00	Splunk data model