https://community.splunk.com/t5/Getting-Data-In/How-is-WinHostMon-data-gathered/m-p/571001#M101178 <P>I'm trying to gather how many CPUs and Cores a server has but, it seems like on most VMs the CPUs and Cores reports as just 1 regardless of the actual number.<BR /><BR />Here is the search I was running:</P><P>index=windows sourcetype=winhostmon source=processor<BR />| table host cpu* Number*<BR />| dedup host</P><P>And here is an section of the output:</P><TABLE border="0" width="448" cellspacing="0" cellpadding="0"><TBODY><TR><TD width="64" height="20">host</TD><TD width="64">cpu_architecture</TD><TD width="64">cpu_cores</TD><TD width="64">cpu_count</TD><TD width="64">cpu_mhz</TD><TD width="64">NumberOfCores</TD><TD width="64">NumberOfProcessors</TD></TR><TR><TD height="20">server1</TD><TD>x64</TD><TD>1</TD><TD>1</TD><TD>2397</TD><TD>1</TD><TD>1</TD></TR><TR><TD height="20">server2</TD><TD>x64</TD><TD>1</TD><TD>1</TD><TD>2397</TD><TD>1</TD><TD>1</TD></TR><TR><TD height="20">server3</TD><TD>x64</TD><TD>1</TD><TD>1</TD><TD>2497</TD><TD>1</TD><TD>1</TD></TR><TR><TD height="20">server4</TD><TD>x64</TD><TD>1</TD><TD>1</TD><TD>2497</TD><TD>1</TD><TD>1</TD></TR><TR><TD height="20">server5</TD><TD>x64</TD><TD>1</TD><TD>1</TD><TD>2397</TD><TD>1</TD><TD>1</TD></TR><TR><TD height="20">server6</TD><TD>x64</TD><TD>1</TD><TD>1</TD><TD>2397</TD><TD>1</TD><TD>1</TD></TR><TR><TD height="20">server7</TD><TD>x64</TD><TD>1</TD><TD>1</TD><TD>2497</TD><TD>1</TD><TD>1</TD></TR><TR><TD height="20">server8</TD><TD>x64</TD><TD>1</TD><TD>1</TD><TD>3193</TD><TD>1</TD><TD>1</TD></TR><TR><TD height="20">server9</TD><TD>x64</TD><TD>1</TD><TD>1</TD><TD>2594</TD><TD>1</TD><TD>1</TD></TR><TR><TD height="20">server10</TD><TD>x64</TD><TD>1</TD><TD>1</TD><TD>2397</TD><TD>1</TD><TD>1</TD></TR><TR><TD height="20">server11</TD><TD>x64</TD><TD>1</TD><TD>1</TD><TD>2397</TD><TD>1</TD><TD>1</TD></TR><TR><TD height="20">server12</TD><TD>x64</TD><TD>1</TD><TD>1</TD><TD>2397</TD><TD>1</TD><TD>1</TD></TR><TR><TD height="20">server13</TD><TD>x64</TD><TD>1</TD><TD>1</TD><TD>2497</TD><TD>1</TD><TD>1</TD></TR><TR><TD height="20">server14</TD><TD>x64</TD><TD>1</TD><TD>1</TD><TD>2597</TD><TD>1</TD><TD>1</TD></TR><TR><TD height="20">server15</TD><TD>x64</TD><TD>1</TD><TD>1</TD><TD>2497</TD><TD>1</TD><TD>1</TD></TR><TR><TD height="20">server16</TD><TD>x64</TD><TD>1</TD><TD>1</TD><TD>2397</TD><TD>1</TD><TD>1</TD></TR><TR><TD height="20">server17</TD><TD>x64</TD><TD>1</TD><TD>1</TD><TD>2397</TD><TD>1</TD><TD>1</TD></TR><TR><TD height="20">server18</TD><TD>x64</TD><TD>1</TD><TD>1</TD><TD>2497</TD><TD>1</TD><TD>1</TD></TR><TR><TD height="20">server19</TD><TD>x64</TD><TD>1</TD><TD>1</TD><TD>2597</TD><TD>1</TD><TD>1</TD></TR><TR><TD height="20">server20</TD><TD>x64</TD><TD>1</TD><TD>1</TD><TD>2497</TD><TD>1</TD><TD>1</TD></TR><TR><TD height="20">server21</TD><TD>x64</TD><TD>1</TD><TD>1</TD><TD>2397</TD><TD>1</TD><TD>1</TD></TR><TR><TD height="20">server22</TD><TD>x64</TD><TD>1</TD><TD>1</TD><TD>2397</TD><TD>1</TD><TD>1</TD></TR><TR><TD height="20">server23</TD><TD>x64</TD><TD>1</TD><TD>1</TD><TD>2497</TD><TD>1</TD><TD>1</TD></TR><TR><TD height="20">server24</TD><TD>x64</TD><TD>1</TD><TD>1</TD><TD>2597</TD><TD>1</TD><TD>1</TD></TR><TR><TD height="20">server25</TD><TD>x64</TD><TD>1</TD><TD>1</TD><TD>2397</TD><TD>1</TD><TD>1</TD></TR></TBODY></TABLE><P><BR /><BR />This is what I have in my inputs.conf</P><P>[WinHostMon://Processor]</P><P>interval = 300</P><P>disabled = 0</P><P>type = Processor<BR /><BR />What commands or data sources are used to gather this data? I want to view this data on the server itself and see if the server is reporting it to Splunk wrong(my assumption) or if there is a bug in winhostmon.</P><P>&nbsp;</P><P>Thanks!</P> Thu, 14 Oct 2021 14:04:51 GMT joeybagofdonuts 2021-10-14T14:04:51Z https://community.splunk.com/t5/Getting-Data-In/How-is-WinHostMon-data-gathered/m-p/571001#M101178 <P>I'm trying to gather how many CPUs and Cores a server has but, it seems like on most VMs the CPUs and Cores reports as just 1 regardless of the actual number.<BR /><BR />Here is the search I was running:</P><P>index=windows sourcetype=winhostmon source=processor<BR />| table host cpu* Number*<BR />| dedup host</P><P>And here is an section of the output:</P><TABLE border="0" width="448" cellspacing="0" cellpadding="0"><TBODY><TR><TD width="64" height="20">host</TD><TD width="64">cpu_architecture</TD><TD width="64">cpu_cores</TD><TD width="64">cpu_count</TD><TD width="64">cpu_mhz</TD><TD width="64">NumberOfCores</TD><TD width="64">NumberOfProcessors</TD></TR><TR><TD height="20">server1</TD><TD>x64</TD><TD>1</TD><TD>1</TD><TD>2397</TD><TD>1</TD><TD>1</TD></TR><TR><TD height="20">server2</TD><TD>x64</TD><TD>1</TD><TD>1</TD><TD>2397</TD><TD>1</TD><TD>1</TD></TR><TR><TD height="20">server3</TD><TD>x64</TD><TD>1</TD><TD>1</TD><TD>2497</TD><TD>1</TD><TD>1</TD></TR><TR><TD height="20">server4</TD><TD>x64</TD><TD>1</TD><TD>1</TD><TD>2497</TD><TD>1</TD><TD>1</TD></TR><TR><TD height="20">server5</TD><TD>x64</TD><TD>1</TD><TD>1</TD><TD>2397</TD><TD>1</TD><TD>1</TD></TR><TR><TD height="20">server6</TD><TD>x64</TD><TD>1</TD><TD>1</TD><TD>2397</TD><TD>1</TD><TD>1</TD></TR><TR><TD height="20">server7</TD><TD>x64</TD><TD>1</TD><TD>1</TD><TD>2497</TD><TD>1</TD><TD>1</TD></TR><TR><TD height="20">server8</TD><TD>x64</TD><TD>1</TD><TD>1</TD><TD>3193</TD><TD>1</TD><TD>1</TD></TR><TR><TD height="20">server9</TD><TD>x64</TD><TD>1</TD><TD>1</TD><TD>2594</TD><TD>1</TD><TD>1</TD></TR><TR><TD height="20">server10</TD><TD>x64</TD><TD>1</TD><TD>1</TD><TD>2397</TD><TD>1</TD><TD>1</TD></TR><TR><TD height="20">server11</TD><TD>x64</TD><TD>1</TD><TD>1</TD><TD>2397</TD><TD>1</TD><TD>1</TD></TR><TR><TD height="20">server12</TD><TD>x64</TD><TD>1</TD><TD>1</TD><TD>2397</TD><TD>1</TD><TD>1</TD></TR><TR><TD height="20">server13</TD><TD>x64</TD><TD>1</TD><TD>1</TD><TD>2497</TD><TD>1</TD><TD>1</TD></TR><TR><TD height="20">server14</TD><TD>x64</TD><TD>1</TD><TD>1</TD><TD>2597</TD><TD>1</TD><TD>1</TD></TR><TR><TD height="20">server15</TD><TD>x64</TD><TD>1</TD><TD>1</TD><TD>2497</TD><TD>1</TD><TD>1</TD></TR><TR><TD height="20">server16</TD><TD>x64</TD><TD>1</TD><TD>1</TD><TD>2397</TD><TD>1</TD><TD>1</TD></TR><TR><TD height="20">server17</TD><TD>x64</TD><TD>1</TD><TD>1</TD><TD>2397</TD><TD>1</TD><TD>1</TD></TR><TR><TD height="20">server18</TD><TD>x64</TD><TD>1</TD><TD>1</TD><TD>2497</TD><TD>1</TD><TD>1</TD></TR><TR><TD height="20">server19</TD><TD>x64</TD><TD>1</TD><TD>1</TD><TD>2597</TD><TD>1</TD><TD>1</TD></TR><TR><TD height="20">server20</TD><TD>x64</TD><TD>1</TD><TD>1</TD><TD>2497</TD><TD>1</TD><TD>1</TD></TR><TR><TD height="20">server21</TD><TD>x64</TD><TD>1</TD><TD>1</TD><TD>2397</TD><TD>1</TD><TD>1</TD></TR><TR><TD height="20">server22</TD><TD>x64</TD><TD>1</TD><TD>1</TD><TD>2397</TD><TD>1</TD><TD>1</TD></TR><TR><TD height="20">server23</TD><TD>x64</TD><TD>1</TD><TD>1</TD><TD>2497</TD><TD>1</TD><TD>1</TD></TR><TR><TD height="20">server24</TD><TD>x64</TD><TD>1</TD><TD>1</TD><TD>2597</TD><TD>1</TD><TD>1</TD></TR><TR><TD height="20">server25</TD><TD>x64</TD><TD>1</TD><TD>1</TD><TD>2397</TD><TD>1</TD><TD>1</TD></TR></TBODY></TABLE><P><BR /><BR />This is what I have in my inputs.conf</P><P>[WinHostMon://Processor]</P><P>interval = 300</P><P>disabled = 0</P><P>type = Processor<BR /><BR />What commands or data sources are used to gather this data? I want to view this data on the server itself and see if the server is reporting it to Splunk wrong(my assumption) or if there is a bug in winhostmon.</P><P>&nbsp;</P><P>Thanks!</P> Thu, 14 Oct 2021 14:04:51 GMT https://community.splunk.com/t5/Getting-Data-In/How-is-WinHostMon-data-gathered/m-p/571001#M101178 joeybagofdonuts 2021-10-14T14:04:51Z