https://community.splunk.com/t5/Splunk-Dev/What-is-pctIdle-in-splunk-index-os/m-p/453547#M8267 <P>Brilliant Thank you</P> Wed, 08 May 2019 10:28:39 GMT Shashank_87 2019-05-08T10:28:39Z https://community.splunk.com/t5/Splunk-Dev/What-is-pctIdle-in-splunk-index-os/m-p/453545#M8265 <P>Hi, </P> <P>What is this field pctIdle which automatically gets extracted when we use multikv command?<BR /> Is it the avg cpu load?<BR /> Is it the percentage of time when CPU was idle?<BR /> If i need to calculate the CPU utilisation % of my 2 host, which query and sourcetype should i use from the below 2 queries?</P> <PRE><CODE>1. index=os sourcetype=top host="host1" OR host="host2" | timechart span=5m values(pctCPU) by host 2.index=os sourcetype=cpu host="host1" OR host="host2" | eval Percent_CPU_Load = 100 - pctIdle | timechart avg(Percent_CPU_Load) by host </CODE></PRE> <P>Appreciate if someone can help</P> Mon, 10 Sep 2018 21:44:28 GMT https://community.splunk.com/t5/Splunk-Dev/What-is-pctIdle-in-splunk-index-os/m-p/453545#M8265 Shashank_87 2018-09-10T21:44:28Z https://community.splunk.com/t5/Splunk-Dev/What-is-pctIdle-in-splunk-index-os/m-p/453546#M8266 <P><a href="https://community.splunk.com/t5/user/viewprofilepage/user-id/108973">@Shashank_87</a>,</P> <P><CODE>pctIdle</CODE> or Percent Idle Time is percentage of time that the CPU or CPUs were idle and the system did not have an outstanding disk I/O request. Have a look at this to see a comparison of commands used : <A href="https://www.cyberciti.biz/tips/how-do-i-find-out-linux-cpu-utilization.html" target="_blank">https://www.cyberciti.biz/tips/how-do-i-find-out-linux-cpu-utilization.html</A></P> <P>If you need to calculate CPU utilisation % of hosts, use <CODE>eval Percent_CPU_Usage = 100 - pctIdle</CODE> , see <A href="http://docs.splunk.com/Documentation/SplunkLight/7.0.1/Examples/Createsearch" target="_blank">Percent_CPU_Usage</A></P> <P>On another note, do you have <CODE>pctCPU</CODE> field? As far as I have seen, the headers for CPU utilization are </P> <PRE><CODE>CPU pctUser pctNice pctSystem pctIowait pctIdle </CODE></PRE> <P>Which are </P> <PRE><CODE>CPU : CPU number %user: Percentage of CPU utilization that occurred while executing at the user level (application). %nice: Percentage of CPU utilization that occurred while executing at the user level with nice priority. %system: Percentage of CPU utilization that occurred while executing at the system level (kernel). %iowait: Percentage of time that the CPU or CPUs were idle during which the system had an outstanding disk I/O request. %idle: Percentage of time that the CPU or CPUs were idle and the system did not have an outstanding disk I/O request. </CODE></PRE> Tue, 29 Sep 2020 21:10:36 GMT https://community.splunk.com/t5/Splunk-Dev/What-is-pctIdle-in-splunk-index-os/m-p/453546#M8266 renjith_nair 2020-09-29T21:10:36Z https://community.splunk.com/t5/Splunk-Dev/What-is-pctIdle-in-splunk-index-os/m-p/453547#M8267 <P>Brilliant Thank you</P> Wed, 08 May 2019 10:28:39 GMT https://community.splunk.com/t5/Splunk-Dev/What-is-pctIdle-in-splunk-index-os/m-p/453547#M8267 Shashank_87 2019-05-08T10:28:39Z