topic Re: Trying to chart process over time unsuccessfully with CPU query in Splunk Search

Trying to chart process over time unsuccessfully with CPU query

mightaswelby — Thu, 13 Jul 2017 20:32:28 GMT

Able to get the expected value running this query, however how would I plot this over time as a timechart?

sourcetype=Script:RunningProc eventtype=Security-proc1 | appendpipe [stats avg(CPUPct) as "CPU %" by Instance] | stats sum(CPU %)

output:
sum(CPU %)
0.156074

Re: Trying to chart process over time unsuccessfully with CPU query

somesoni2 — Thu, 13 Jul 2017 20:40:56 GMT

Try this

sourcetype=Script:RunningProc eventtype=Security-proc1
| timechahrt avg(CPUPct) by instance

Re: Trying to chart process over time unsuccessfully with CPU query

mightaswelby — Thu, 13 Jul 2017 20:58:06 GMT

Thanks for the response somesoni2, however in order to produce the accurate value, the | stats sum(CPU %) needs to be included in the query. (issues with the way windows perfmon passes cpu data). looking to timechart the result sum(CPU % over a period of time and having no luck.

sourcetype=Script:RunningProc eventtype=Security-proc1 | appendpipe [stats avg(CPUPct) as "CPU %" by Instance] | stats sum(CPU %)

output:
sum(CPU %)
0.156074

Re: Trying to chart process over time unsuccessfully with CPU query

somesoni2 — Thu, 13 Jul 2017 21:18:53 GMT

How about this? (update span value in bucket command and timechart command per your need)

sourcetype=Script:RunningProc eventtype=Security-proc1 | bucket span=15m _time | stats avg(CPUPct) as "CPU %" by _time instance | timechart span=15m sum("CPU %")  as "CPU %"

Re: Trying to chart process over time unsuccessfully with CPU query

mightaswelby — Fri, 14 Jul 2017 11:53:36 GMT

This seemed to work perfectly, thank you somesoni2