topic Re: cpu utilization in Monitoring Splunk

cpu utilization

vaibhavbeohar — Wed, 30 May 2012 07:57:22 GMT

while seeing CPU utilization of my server in spunk, i am getting following fields, can you please explain

sourcetype="Perfmon:CPU Load"
collection="CPU Load"
object=Processor
counter="% User Time"
instance=_Total
Value=0.029156509359650525

what is the meaning of Value in terms of CPU utilization.
and also can you please help me out to write search to get CPU utilization with host name in my clustered servers

Many Thanks in advance.

Thanks.

Re: cpu utilization

Drainy — Wed, 30 May 2012 10:16:58 GMT

As per; http://msdn.microsoft.com/en-us/library/ms178072.aspx
% User Time is the time the CPU spends on user run processes. In your case it is a tiny amount but you probably want to look at % Processor Time (have a look here)

Once you have that data you can do some searches to look at utilization but you would need to be more specific for what you want to see.
Have a look at the Windows for Splunk app to get some decent OTB dashboards, which is here.

Re: cpu utilization

vaibhavbeohar — Wed, 30 May 2012 10:46:30 GMT

Thanks for your reply...my concern is about value , what does this Value=0.029156509359650525 means???

Re: cpu utilization

Drainy — Wed, 30 May 2012 11:51:51 GMT

I believe it is the user time in percent, where 1 is 100%

Re: cpu utilization

vaibhavbeohar — Wed, 30 May 2012 12:04:03 GMT

Ok .. I am getting some data via universal forwarder .. i just need a simple search to check cpu utilization in percentage in my remote machine.

Thanks

Re: cpu utilization

vaibhavbeohar — Fri, 01 Jun 2012 07:52:13 GMT

Hi, Please help me to write search to get cpu utilization in percentage

Re: cpu utilization

kristian_kolb — Mon, 25 Jun 2012 11:26:38 GMT

To convert the value of Value (0.02931234123) to 2.9;

   ...| eval newValue=round(Value * 100,1)

To convert the value of Value (0.02931234123) to 2.93;

   ...| eval newValue=round(Value * 100,2)

To change it into a string ('2.93 %') as well:

   ...| eval newValue=round(Value * 100,2) . " %"

Hope this helps,

Kristian