https://community.splunk.com/t5/Splunk-Search/problem-in-query/m-p/87825#M22441 <P>It is working fine.</P> <P>Thanks,<BR /> Rajiv</P> Thu, 08 Mar 2012 23:10:38 GMT rajiv_kumar 2012-03-08T23:10:38Z https://community.splunk.com/t5/Splunk-Search/problem-in-query/m-p/87822#M22438 <P>I am using this query to get the Percentage CPU Utilization.</P> <P>index=os sourcetype="cpu" minutesago=15 | eval human_readable_time=strftime(_time, "%Y-%d-%m %H:%M:%S") | <BR /> table host, human_readable_time, pctUser, pctIdle</P> <P>It work fine on Splunk 4.5 version but i am not getting data on 4.2.3 version, i am not getting data for pctUser and pctIdle fields</P> <P>Kindly Help</P> Mon, 28 Sep 2020 11:29:51 GMT https://community.splunk.com/t5/Splunk-Search/problem-in-query/m-p/87822#M22438 kuldeepsingh99 2020-09-28T11:29:51Z https://community.splunk.com/t5/Splunk-Search/problem-in-query/m-p/87823#M22439 <P>Which version of Splunk are you running? 4.3.1 is the latest.</P> Thu, 08 Mar 2012 19:29:34 GMT https://community.splunk.com/t5/Splunk-Search/problem-in-query/m-p/87823#M22439 ChrisG 2012-03-08T19:29:34Z https://community.splunk.com/t5/Splunk-Search/problem-in-query/m-p/87824#M22440 <P>i used the following to get it to work on 4.5:</P> <PRE><CODE>index=os sourcetype="cpu" minutesago=15 | multikv forceheader=1 | eval human_readable_time=strftime(_time, "%Y-%d-%m %H:%M:%S") | table host, human_readable_time, pctUser, pctIdle </CODE></PRE> Thu, 08 Mar 2012 20:13:00 GMT https://community.splunk.com/t5/Splunk-Search/problem-in-query/m-p/87824#M22440 MarioM 2012-03-08T20:13:00Z https://community.splunk.com/t5/Splunk-Search/problem-in-query/m-p/87825#M22441 <P>It is working fine.</P> <P>Thanks,<BR /> Rajiv</P> Thu, 08 Mar 2012 23:10:38 GMT https://community.splunk.com/t5/Splunk-Search/problem-in-query/m-p/87825#M22441 rajiv_kumar 2012-03-08T23:10:38Z https://community.splunk.com/t5/Splunk-Search/problem-in-query/m-p/87826#M22442 <P>great! then if you could accept the answer it will be useful for other with same issue.</P> Fri, 09 Mar 2012 05:39:17 GMT https://community.splunk.com/t5/Splunk-Search/problem-in-query/m-p/87826#M22442 MarioM 2012-03-09T05:39:17Z https://community.splunk.com/t5/Splunk-Search/problem-in-query/m-p/87827#M22443 <P>He meant Splunk for Unix/Linux app v4.5</P> Fri, 09 Mar 2012 05:40:20 GMT https://community.splunk.com/t5/Splunk-Search/problem-in-query/m-p/87827#M22443 MarioM 2012-03-09T05:40:20Z