https://community.splunk.com/t5/Splunk-Search/How-to-calculate-the-total-CPU-by-top-result/m-p/49357#M11830 <P>The <CODE>multikv</CODE> command helps you to split the tabular formatted events in to separate ones.</P> <P>You can use a query like this:</P> <PRE><CODE>sourcetype=ps | multikv | stats sum(pctCPU) as sumPctCPU by _time,host | timechart span=1m avg(sumPctCPU) by host </CODE></PRE> Thu, 24 Feb 2011 18:38:24 GMT ziegfried 2011-02-24T18:38:24Z https://community.splunk.com/t5/Splunk-Search/How-to-calculate-the-total-CPU-by-top-result/m-p/49356#M11829 <P>Hi, all, I am a newbie in splunk. I have encounter a problem when play around with *NIX app in Splunk. I am going to calculate the total CPU usage in each minutes</P> <PRE><CODE> PID USER PR NI VIRT RES SHR S pctCPU pctMEM cpuTIME COMMAND 32206 root 15 0 298m 129m 10m S 19.3 0.8 15:46.08 splunkd 14559 root 15 0 13016 1224 708 R 3.9 0.0 0:00.03 top 1 root 15 0 10348 684 576 S 0.0 0.0 0:04.85 init 2 root RT -5 0 0 0 S 0.0 0.0 0:00.08 migration/0 3 root 34 19 0 0 0 S 0.0 0.0 0:00.00 ksoftirqd/0 4 root RT -5 0 0 0 S 0.0 0.0 0:00.00 watchdog/0 5 root RT -5 0 0 0 S 0.0 0.0 0:00.13 migration/1 6 root 34 19 0 0 0 S 0.0 0.0 0:00.00 ksoftirqd/1 7 root RT -5 0 0 0 S 0.0 0.0 0:00.00 watchdog/1 </CODE></PRE> <P>I don't know how to extract the pctCPU value. Any hint?</P> <P>Thank you.</P> <P>Regards, Alister</P> Thu, 24 Feb 2011 12:15:12 GMT https://community.splunk.com/t5/Splunk-Search/How-to-calculate-the-total-CPU-by-top-result/m-p/49356#M11829 wisespot 2011-02-24T12:15:12Z https://community.splunk.com/t5/Splunk-Search/How-to-calculate-the-total-CPU-by-top-result/m-p/49357#M11830 <P>The <CODE>multikv</CODE> command helps you to split the tabular formatted events in to separate ones.</P> <P>You can use a query like this:</P> <PRE><CODE>sourcetype=ps | multikv | stats sum(pctCPU) as sumPctCPU by _time,host | timechart span=1m avg(sumPctCPU) by host </CODE></PRE> Thu, 24 Feb 2011 18:38:24 GMT https://community.splunk.com/t5/Splunk-Search/How-to-calculate-the-total-CPU-by-top-result/m-p/49357#M11830 ziegfried 2011-02-24T18:38:24Z