{
  "changes": [],
  "conditions": [],
  "fieldGroups": [
    {
      "id": "process",
      "title": "Process"
    },
    {
      "id": "cpu",
      "title": "CPU"
    },
    {
      "id": "memory",
      "title": "Memory"
    },
    {
      "id": "disk_io",
      "title": "Disk I/O"
    },
    {
      "id": "network",
      "title": "Network (TCP)"
    }
  ],
  "fieldPrefix": "sparklogs.data.top_processes.",
  "fields": [
    {
      "doc": "The process ID. With `create_time_ts`, it identifies the process. Absent on system and remainder rows.",
      "group": "process",
      "name": "pid",
      "type": "integer"
    },
    {
      "doc": "When the process started, in UTC. Absent on system and remainder rows, which are not processes.",
      "group": "process",
      "name": "create_time_ts",
      "type": "string",
      "unit": "timestamp"
    },
    {
      "doc": "The process's executable file name. On a system or remainder row, the row's name: `(hardware interrupts)`, `(deferred procedure calls)` or `(other processes)`.",
      "group": "process",
      "name": "image_name",
      "type": "string"
    },
    {
      "doc": "The full path of the process's executable. Absent when the agent could not read it while the process ran, and on system and remainder rows. The agent never collects command-line arguments.",
      "group": "process",
      "name": "image_path",
      "type": "string"
    },
    {
      "doc": "The Windows services this process hosts, sorted. Absent when it hosts none.",
      "group": "process",
      "name": "services",
      "type": "string_array"
    },
    {
      "doc": "What the row is: `process` for one listed process; `system` for CPU spent on hardware interrupts or deferred procedure calls (DPCs), with no memory or I/O fields; `remainder` for every process not listed. The remainder's CPU is the machine's busy time minus the other rows, never below 0; when the machine-wide CPU counters could not be read or disagree with the machine's processor count, the system rows are left out and the remainder's CPU is the sum of the unlisted processes.",
      "group": "process",
      "name": "entry_kind",
      "type": "string"
    },
    {
      "doc": "The rankings that listed this process, each taking its ten largest: `cpu`, `ram` (resident memory), `private_commit` (private committed memory), `io_read`, `io_write`, `net_rx` and `net_tx` (TCP payload received and sent, since 1.14.1). Empty on system and remainder rows.",
      "group": "process",
      "name": "top_by",
      "type": "string_array"
    },
    {
      "doc": "Average CPU use over the 5-minute window, as a percentage of all logical cores. The System Idle Process is not listed.",
      "group": "cpu",
      "name": "cpu_busy_pct_avg",
      "type": "float",
      "unit": "percent"
    },
    {
      "doc": "The highest one-minute CPU reading in the window, as a percentage of all logical cores.",
      "group": "cpu",
      "name": "cpu_busy_pct_max_1m",
      "type": "float",
      "unit": "percent"
    },
    {
      "doc": "Physical memory the process held at the end of the window, including pages shared with other processes. On the remainder row, the total for unlisted processes still running then. Absent on system rows and for a process that had exited by then. Adding this up across rows counts shared pages more than once.",
      "group": "memory",
      "name": "resident_bytes",
      "type": "integer",
      "unit": "bytes"
    },
    {
      "doc": "The row's resident memory as a percentage of installed RAM. Shared pages can make these add up to more than 100 across rows. Absent when `resident_bytes` is, or installed RAM was not read.",
      "group": "memory",
      "name": "resident_pct_ram",
      "type": "float",
      "unit": "percent"
    },
    {
      "doc": "Physical memory private to the process at the end of the window. On the remainder row, the total for unlisted processes, absent when any of them lacks a reading. Absent on system rows, for a process that had exited by then, and when Windows did not report it. The total across rows is not the machine's used RAM.",
      "group": "memory",
      "name": "private_resident_bytes",
      "type": "integer",
      "unit": "bytes"
    },
    {
      "doc": "Private memory the process had committed at the end of the window, including memory not currently in RAM (Task Manager's Commit size). On the remainder row, the total for unlisted processes still running then. Absent on system rows and for a process that had exited by then. It is not physical RAM use.",
      "group": "memory",
      "name": "private_commit_bytes",
      "type": "integer",
      "unit": "bytes"
    },
    {
      "doc": "Bytes the row's processes read over the 5-minute window ending at the event time, counting file, pipe, device and network reads. When only part of the window was measured, it covers only that part.",
      "group": "disk_io",
      "name": "read_bytes_5m",
      "type": "integer",
      "unit": "bytes"
    },
    {
      "doc": "Bytes the row's processes wrote over the 5-minute window ending at the event time, counting file, pipe, device and network writes. When only part of the window was measured, it covers only that part.",
      "group": "disk_io",
      "name": "write_bytes_5m",
      "type": "integer",
      "unit": "bytes"
    },
    {
      "doc": "The average read rate over the measured part of the window, counting all process reads, not only disk reads.",
      "group": "disk_io",
      "name": "read_mb_per_s_avg",
      "type": "float",
      "unit": "megabytes_per_second"
    },
    {
      "doc": "The average write rate over the measured part of the window, counting all process writes, not only disk writes.",
      "group": "disk_io",
      "name": "write_mb_per_s_avg",
      "type": "float",
      "unit": "megabytes_per_second"
    },
    {
      "doc": "TCP payload this row's processes received over the 5-minute window, from the connections the agent measures (not all of the machine's TCP traffic). Already counted in the I/O read fields. When TCP was measured, every process and remainder row carries the four TCP fields, 0 when none of the traffic was its own. All four are absent when TCP traffic was not measured for the window, and on system rows.",
      "group": "network",
      "name": "tcp_rx_bytes_5m",
      "type": "integer",
      "unit": "bytes"
    },
    {
      "doc": "TCP payload this row's processes sent over the 5-minute window, including resent data. Absent when TCP traffic was not measured.",
      "group": "network",
      "name": "tcp_tx_bytes_5m",
      "type": "integer",
      "unit": "bytes"
    },
    {
      "doc": "The average rate this row's processes received TCP payload over the time TCP was measured in the window. Absent when TCP traffic was not measured.",
      "group": "network",
      "name": "tcp_rx_bytes_per_s_avg",
      "type": "float",
      "unit": "bytes_per_second"
    },
    {
      "doc": "The average rate this row's processes sent TCP payload, including resent data, over the time TCP was measured in the window. Absent when TCP traffic was not measured.",
      "group": "network",
      "name": "tcp_tx_bytes_per_s_avg",
      "type": "float",
      "unit": "bytes_per_second"
    }
  ],
  "name": "Top processes",
  "occurrences": [],
  "page": "/docs/it-fleet-intelligence/reference/topics/top-processes",
  "status": "live",
  "summary": "Processes selected by CPU, resident and private memory, read/write I/O and TCP payload traffic, plus system CPU and an unlisted-process remainder.",
  "topic": "top_processes"
}