topic Re: Why is the Windows perfmon data in Splunk for percentage processor time different from the performance counter value on the server? in Getting Data In

Why is the Windows perfmon data in Splunk for percentage processor time different from the performance counter value on the server?

shreyasathavale — Sat, 27 Jun 2015 01:04:27 GMT

I have this Splunk stanza below:

[perfmon://CPUTime]
interval = 30
object = Processor
counters = % Processor Time
instances = _Total
disabled = 0
index = perfmon

When I run this search, I get a result of around 50+%

index = perfmon ( datacenter="iad" ) ( environment="prod" ) ( host="ms10191" ) ( counter="% Processor Time" ) ( instance="_Total" ) | eval name=host+"-"+counter+"-"+instance | timechart avg(Value) by name

But when I check through the Performance Counter on the server, I am getting a value around 15-20%

Is splunk showing wrong data?

Re: Why is the Windows perfmon data in Splunk for percentage processor time different from the performance counter value on the server?

bpitts2 — Wed, 13 Jan 2016 17:11:56 GMT

I know this is old, but I was hoping you may have found an answer. I'm also observing different returned values in splunk than what is in perfmon local to the server.

Re: Why is the Windows perfmon data in Splunk for percentage processor time different from the performance counter value on the server?

s2_splunk — Wed, 13 Jan 2016 20:00:52 GMT

Are the time spans that you are averaging over in your Splunk search the same than the sampling periods configured in Perfmon for your Windows hosts? If those don't match, one would expect the results to be different, no? Note that you are pulling Perfmon data every 30 seconds.