topic Re: Getting "top 3" (Windows) processes, sorted by CPU usage, when CPU usage goes over xx% in Monitoring Splunk

Getting "top 3" (Windows) processes, sorted by CPU usage, when CPU usage goes over xx%

so_edv1 — Fri, 08 Mar 2019 08:51:03 GMT

Hello everyone,

Pretty new to Splunk and, to be honest, I'm going under in work so I don't have time to work myself in a lot 😕 and so I hoped someone could help me with something, I somehow couldn't find some solution for..

We. I. want to monitor our VDA Servers and get informed / an e-mail once the CPU usage goes over a certain amount. Let's say 70%.

This shouldn't happen. But of course sometimes it does. And we want to know through which process.

So we basically want to get a short e-mail.

"Hey. CPU load on X is over the limit.

Here are the top 3 processes, sorted by CPU load produced:

MS Teams - 30%
Chrome - 25%
Outlook 20%

Is there a pre-made solution someone knows? Or a powershell script?

Re: Getting "top 3" (Windows) processes, sorted by CPU usage, when CPU usage goes over xx%

richgalloway — Fri, 08 Mar 2019 14:00:28 GMT

First, you must have performance data from your VDA servers indexed in Splunk. You can use a universal forwarder to send perfmon:CPU events to do that.

[perfmon://Processor]
object = Processor
instances = _Total
counters = % Processor Time;% User Time
interval = 60
disabled = 0

Once you have the data, it's easy to craft a search that runs every few minutes to look for servers with high CPU utilization.

index=windows | stats sum('% Processor Time') as PctCPU | where PctCPU > 70

See https://docs.splunk.com/Documentation/Splunk/7.2.4/Data/MonitorWindowsperformance for details.

Re: Getting "top 3" (Windows) processes, sorted by CPU usage, when CPU usage goes over xx%

so_edv1 — Mon, 11 Mar 2019 06:51:49 GMT

Sorry for the late reply, hope everyone had a nice weekend 🙂

Going to try this out.

Thank you.