topic Re: CPU Utilization of Splunk Forwarder running on Linux machine showing wrong values in Getting Data In

CPU Utilization of Splunk Forwarder running on Linux machine showing wrong values

hishamjan — Mon, 29 Mar 2021 17:01:40 GMT

Hi,

I have two servers running on Centos that have Universal Forwarder installed and I've enabled the following:

But using htop command on the servers, the CPU utilization is almost 100% but on splunk, it shows 20-30% at most.

Below is the query I used to find the CPU utilization for each available host:

host=* source="vmstat" | bucket span=300s _time | stats max(memUsedPct) as memUsedPct by _time host | timechart span=300s max(memUsedPct) as "Used Memory Percentage" by host limit=0

Please, is there a way to resonate with the htop results?

Re: CPU Utilization of Splunk Forwarder running on Linux machine showing wrong values

s2_splunk — Mon, 29 Mar 2021 17:06:10 GMT

You are asking about CPU utilization, but your search query is using memUsedPct (memory)....?

Re: CPU Utilization of Splunk Forwarder running on Linux machine showing wrong values

hishamjan — Mon, 29 Mar 2021 18:42:34 GMT

Hi,

this is what I was getting in my search results.

please refer to the picture below:

Hope this gives you an idea about the memUsedPct (memory) I've indexed.

Re: CPU Utilization of Splunk Forwarder running on Linux machine showing wrong values

hishamjan — Mon, 29 Mar 2021 18:49:51 GMT

this is the visualization of different hosts using the above query.

Hope this also gives you a better idea of what I'm achieving vs what I really wanna achieve.