topic Re: PercentProcessorTime inaccurate in Splunk Search

PercentProcessorTime inaccurate

chowell — Mon, 28 Sep 2020 09:40:02 GMT

On a Windows 2008 R2 server, I've been comparing the %Processor Time counter on the _Total instance from Perfmon with the PercentProcessorTime counter on the _Total instance of the PerfOS_Processor object in Splunk. The output from the counters is never the same. In Splunk, I created a separate index and started sampling at one second intervals to see if I could get the two counters to line up but they don't. I'm running version 4.2.1 build 98164. Can someone help me discovery why there is a discrepancy?

Thanks,

--Carl

Re: PercentProcessorTime inaccurate

hazekamp — Thu, 09 Jun 2011 16:26:16 GMT

Carl,

I would suspect that unless the counters happened to kick off at the exact same time there could be a discrepancy in %Processor Time. If you were to look at the averages using timechart over a reasonable period of time, do the graphs align?

Re: PercentProcessorTime inaccurate

chowell — Thu, 09 Jun 2011 19:48:31 GMT

Sorry, I was being a little to granular with the problem description. The values returned are not even close. For example, Splunk might report a value of 58 PercentProcessorTime and I'll look to see if Perfmon reports that value within say 10 seconds of when Splunk reports it and it never happens.

This same behavior is occurring on all the machines we are monitoring this way. They are all physical machines. I can't tell you that Splunk ever reported the correct values. I just know that at review meetings engineers are getting freaked out when they see the numbers Splunk is reporting.

Re: PercentProcessorTime inaccurate

hazekamp — Thu, 09 Jun 2011 19:54:16 GMT

Thanks for that clarification. Based on your description I too find this odd. I would also recommend filing an issue on this for support to look into.