topic Re: Splunk CPU Usage Query in Splunk Search

Splunk CPU Usage Query

sheepIT — Fri, 28 Jul 2023 17:11:13 GMT

Hello all,

I am relatively new to Splunk, having just inherited a whole Splunk environment due to our former Splunk Admin leaving. I'm having issues with setting up a dashboard that returns the top 10 windows hosts with the most CPU usage, essentially I need a query that would calculate and return that. I can find the windows hosts under the _internal and perfmon indexes.

I managed to find and customize this query:

index=perfmon object=Process counter="%_Processor_Time" host=WINSERVER1 earliest=-2m latest=now NOT instance IN(_Total,Idle,System)
| stats perc90(Value) as Value by host
| top limit=10 Value by host

However, it returns all the hosts in the index, and not the top 10 hosts with the highest CPU usage. Also comparing the CPU usage, it seems like it is incorrect, as when I open task manager and compare, they are noticeably different, so it makes me wonder if my calculation is off? Or what calculation would be most accurate in determining the CPU usage of individual hosts?

Re: Splunk CPU Usage Query

gcusello — Sat, 29 Jul 2023 05:19:26 GMT

Hi @sheepIT,

you have two solutions:

the top command,
the stats and sort commands:

top command

index=perfmon object=Process counter="%_Processor_Time" host=WINSERVER1 earliest=-2m latest=now NOT instance IN(_Total,Idle,System) | top perc90(Value) as Value by host limit=10

stats and sort commands

index=perfmon object=Process counter="%_Processor_Time" host=WINSERVER1 earliest=-2m latest=now NOT instance IN(_Total,Idle,System) | stats perc90(Value) as Value by host | sort 10 BY Value

the first is easier but I usually use the second solution.

Ciao.

Giuseppe

Re: Splunk CPU Usage Query

sheepIT — Mon, 31 Jul 2023 16:26:25 GMT

Hi @gcusello

I used most of what you did, along with some functions I found and now have it like this.

index=perfmon object=Process counter="%_Processor_Time" host=WINSERVER1 earliest=-2m latest=now NOT instance IN(_Total,Idle,System)
| stats perc90(Value) as Value by host

| eval Value=round(Value,2)
| sort -Value | head 10

Re: Splunk CPU Usage Query

gcusello — Tue, 01 Aug 2023 05:51:48 GMT

Hi @sheepIT,

is it ok for you?

Ciao.

Giuseppe

Re: Splunk CPU Usage Query

gcusello — Tue, 01 Aug 2023 12:21:35 GMT

Hi @sheepIT,

good for you, see next time!

Ciao and happy splunking

Giuseppe

P.S.: Karma Points are appreciated 😉