https://community.splunk.com/t5/Getting-Data-In/Need-CPU-and-Memory-peak-utilization-of-multiple-VM-s/m-p/496133#M84625 <P>Hi All,<BR /> I am very new to Splunk.</P> <P>My organisation uses Splunk for all infra monitoring, I am trying to get the "Peak CPU average" (or) the highest CPU hit per instance in last 24 hours of all my Azure VM's (it's Windows and Linux combo).</P> <P>I am able to get average average using bellow query, but I need peak average - Can you please help.</P> <P>host=AZR* index="perfmon" source="Perfmon:CPU" counter="% Processor Time" | stats avg(Value) as avgcpu by host</P> <P>host=AZR* index="perfmon" source="Perfmon:Memory" counter="% Committed Bytes In Use" | stats avg(Value) as AvgMemory by host</P> Sun, 26 Jan 2020 11:22:46 GMT bhanue 2020-01-26T11:22:46Z https://community.splunk.com/t5/Getting-Data-In/Need-CPU-and-Memory-peak-utilization-of-multiple-VM-s/m-p/496133#M84625 <P>Hi All,<BR /> I am very new to Splunk.</P> <P>My organisation uses Splunk for all infra monitoring, I am trying to get the "Peak CPU average" (or) the highest CPU hit per instance in last 24 hours of all my Azure VM's (it's Windows and Linux combo).</P> <P>I am able to get average average using bellow query, but I need peak average - Can you please help.</P> <P>host=AZR* index="perfmon" source="Perfmon:CPU" counter="% Processor Time" | stats avg(Value) as avgcpu by host</P> <P>host=AZR* index="perfmon" source="Perfmon:Memory" counter="% Committed Bytes In Use" | stats avg(Value) as AvgMemory by host</P> Sun, 26 Jan 2020 11:22:46 GMT https://community.splunk.com/t5/Getting-Data-In/Need-CPU-and-Memory-peak-utilization-of-multiple-VM-s/m-p/496133#M84625 bhanue 2020-01-26T11:22:46Z https://community.splunk.com/t5/Getting-Data-In/Need-CPU-and-Memory-peak-utilization-of-multiple-VM-s/m-p/496134#M84626 <P>There are several ways to do this - use <CODE>|stats max(Value)</CODE> for the highest value across your result set <BR /> If you want the peak average value, you can use your existing search, and just massage the results a bit with something like</P> <P><CODE>...| stats avg(Value) as avgcpu by host|sort - avgcpu|head 1</CODE></P> <P>If you wanted to use the stats function again, you could instead do:</P> <P><CODE>...| stats avg(Value) as avgcpu by host|stats max(avgcpu) as maxAvgCpu by host</CODE></P> Sun, 26 Jan 2020 11:31:49 GMT https://community.splunk.com/t5/Getting-Data-In/Need-CPU-and-Memory-peak-utilization-of-multiple-VM-s/m-p/496134#M84626 nickhills 2020-01-26T11:31:49Z