topic Re: Windows monitoring- high CPU % process - Splunk Alert in Splunk Search

Windows monitoring- high CPU % process - Splunk Alert

dkgs — Mon, 24 Aug 2020 11:59:32 GMT

Hello,

I wanted to setup alert in Splunk cloud for windows machines when CPU% is greater than 90.

Please do help how to set up the same.

My query is not working properly as expected.

Inputs.conf file configurations

[WMI:ProcessesCPU]
interval = 60
wql = SELECT Name, PercentProcessorTime, PercentPrivilegedTime, PercentUserTime, ThreadCount FROM Win32_PerfFormattedData_PerfProc_Process WHERE PercentProcessorTime>0
disabled = 0

Re: Windows monitoring- high CPU % process - Splunk Alert

to4kawa — Mon, 24 Aug 2020 12:05:28 GMT

index="index1" host=windows1 source="WMI:ProcessesCPU" PercentProcessorTime > 90

How about this?

Re: Windows monitoring- high CPU % process - Splunk Alert

dkgs — Mon, 24 Aug 2020 13:07:24 GMT

@to4kawa thank you for the response.But this won't help. Different processes will be coming in PercentProcessorTime. We need to check the total cpu % greater than 90.

Any other way ? Please do suggest

Re: Windows monitoring- high CPU % process - Splunk Alert

to4kawa — Mon, 24 Aug 2020 13:11:39 GMT

what's total?
sum? average? other?

Re: Windows monitoring- high CPU % process - Splunk Alert

dkgs — Mon, 24 Aug 2020 13:19:16 GMT

@to4kawa Total of all CPU processes in the windows machine. I am also confused whether to take sum or average in this case. Normally how we see as total cpu % in task manager in a windows machine . Also we need to check for real time

Below is the wql query written in wmi file

wql = SELECT Name, PercentProcessorTime, PercentPrivilegedTime, PercentUserTime, ThreadCount FROM Win32_PerfFormattedData_PerfProc_Process WHERE PercentProcessorTime>0

Re: Windows monitoring- high CPU % process - Splunk Alert

to4kawa — Mon, 24 Aug 2020 21:01:00 GMT

well, why do you use `| WHERE NOT Name="_Total"` ?

_Total is total cpu usage. so, I asked you.

in wql. where ... AND Name="_Total" is simple solution.

Re: Windows monitoring- high CPU % process - Splunk Alert

dkgs — Tue, 25 Aug 2020 05:13:17 GMT

@to4kawa Thank you for the help.

Also there is a requirement to find the high cpu consumption process not the total cpu % , how the query should be and what should be the wql query/ configuration file changes.

Thanks in advance