https://community.splunk.com/t5/Alerting/How-to-get-average-CPU-utilization-and-create-an-alert/m-p/487688#M8633 <P>I am new to Splunk.<BR />I have tried to add CPU data locally in Splunk, and I am able to get data core-wise but I need average CPU utilization. How I can do this?</P> <P>04/27/2020 23:09:19.414 +0530<BR />11:09:19.414 PM</P> <PRE><CODE>collection=cpu12 object="TCPIP Performance Diagnostics (Per-CPU)" counter="TCP current connections" instance=CPU3 Value=7 Collapse host = * source = Perfmon:cpu12 sourcetype = Perfmon:cpu12 </CODE></PRE> <P>04/27/2020 23:09:19.414 +0530<BR />11:09:19.414 PM</P> <PRE><CODE>collection=cpu12 object="TCPIP Performance Diagnostics (Per-CPU)" counter="TCP current connections" instance=CPU2 Value=6 Collapse host = * source = Perfmon:cpu12 sourcetype = Perfmon:cpu12 </CODE></PRE> <P>04/27/2020 23:09:19.414 +0530<BR />11:09:19.414 PM</P> <PRE><CODE>collection=cpu12 object="TCPIP Performance Diagnostics (Per-CPU)" counter="TCP current connections" instance=CPU1 Value=7 Collapse host = * source = Perfmon:cpu12 sourcetype = Perfmon:cpu12 </CODE></PRE> <P>04/27/2020 23:09:19.414 +0530<BR />11:09:19.414 PM</P> <PRE><CODE>collection=cpu12 object="TCPIP Performance Diagnostics (Per-CPU)" counter="TCP current connections" instance=CPU0 Value=8 Collapse host = * source = Perfmon:cpu12 sourcetype = Perfmon:cpu12 </CODE></PRE> <P>thanks</P> Tue, 09 Jun 2020 21:50:38 GMT amitrai197 2020-06-09T21:50:38Z https://community.splunk.com/t5/Alerting/How-to-get-average-CPU-utilization-and-create-an-alert/m-p/487688#M8633 <P>I am new to Splunk.<BR />I have tried to add CPU data locally in Splunk, and I am able to get data core-wise but I need average CPU utilization. How I can do this?</P> <P>04/27/2020 23:09:19.414 +0530<BR />11:09:19.414 PM</P> <PRE><CODE>collection=cpu12 object="TCPIP Performance Diagnostics (Per-CPU)" counter="TCP current connections" instance=CPU3 Value=7 Collapse host = * source = Perfmon:cpu12 sourcetype = Perfmon:cpu12 </CODE></PRE> <P>04/27/2020 23:09:19.414 +0530<BR />11:09:19.414 PM</P> <PRE><CODE>collection=cpu12 object="TCPIP Performance Diagnostics (Per-CPU)" counter="TCP current connections" instance=CPU2 Value=6 Collapse host = * source = Perfmon:cpu12 sourcetype = Perfmon:cpu12 </CODE></PRE> <P>04/27/2020 23:09:19.414 +0530<BR />11:09:19.414 PM</P> <PRE><CODE>collection=cpu12 object="TCPIP Performance Diagnostics (Per-CPU)" counter="TCP current connections" instance=CPU1 Value=7 Collapse host = * source = Perfmon:cpu12 sourcetype = Perfmon:cpu12 </CODE></PRE> <P>04/27/2020 23:09:19.414 +0530<BR />11:09:19.414 PM</P> <PRE><CODE>collection=cpu12 object="TCPIP Performance Diagnostics (Per-CPU)" counter="TCP current connections" instance=CPU0 Value=8 Collapse host = * source = Perfmon:cpu12 sourcetype = Perfmon:cpu12 </CODE></PRE> <P>thanks</P> Tue, 09 Jun 2020 21:50:38 GMT https://community.splunk.com/t5/Alerting/How-to-get-average-CPU-utilization-and-create-an-alert/m-p/487688#M8633 amitrai197 2020-06-09T21:50:38Z https://community.splunk.com/t5/Alerting/How-to-get-average-CPU-utilization-and-create-an-alert/m-p/487689#M8634 <P>First, you need to be regularly ingesting that data. connections is not CPU utilization, usually, but let's suppose it was.</P> <P>Then, you do this - </P> <PRE><CODE> Your search that gets just those events across time | stats avg(Value) as Value by host instance </CODE></PRE> <P>That gets you the average for each instance. Then you average again across instances</P> <PRE><CODE> | stats avg(Value) as Value by host </CODE></PRE> <P>However, depending on your monitoring software, there may also be another record there that contains the overall host information, regardless of instance. Check for that first.</P> Tue, 28 Apr 2020 16:52:29 GMT https://community.splunk.com/t5/Alerting/How-to-get-average-CPU-utilization-and-create-an-alert/m-p/487689#M8634 DalJeanis 2020-04-28T16:52:29Z