topic Re: Splunk Query for Windows Process Names and CPU Utilizations in Splunk Search

Splunk Query for Windows Process Names and CPU Utilizations

Raja_Selvaraj — Wed, 12 Jun 2024 17:03:05 GMT

Hi all,

Can you please help me with the Splunk query to list the Windows Process Names and CPU utilizations for the particular hostname. I have made the query as follows:-

index=tuuk_perfmon source="Perfmon:Process" counter="% Processor Time" host=*hostname* (instance!="_Total" AND instance!="Idle" AND instance!="System") | eval 'CPU'=round(process_cpu_used_percent,2) | timechart latest('CPU') by process_name

With the above mentioned query, i can able to get the CPU utilization results for listed Windows Process names, but when analyzing the results, for particular time frame there are multiple 100% CPU utilization for mutiple Windows process names.

Could someone please suggest or validate whether i am getting valid results and also the reason for multiple 100% CPU utilization?

Re: Splunk Query for Windows Process Names and CPU Utilizations

yuanliu — Wed, 12 Jun 2024 20:21:37 GMT

Process names, but when analyzing the results, for particular time frame there are multiple 100% CPU utilization for mutiple Windows process names.

Are these 100% utilization for multiple process names on a single host or multiple hosts? Your last stats is | timechart latest('CPU') by process_name, which aggregates across all that match host=*hostname*. Is there any reason why there must not be multiple 100%?

Maybe you are looking for groupby process_name AND host?

The output will not be pretty but it's an idea.

Re: Splunk Query for Windows Process Names and CPU Utilizations

bowesmana — Wed, 12 Jun 2024 22:12:03 GMT

@Raja_Selvaraj

Take a look at this article on Process\% Processor Time

https://learn.microsoft.com/en-us/archive/technet-wiki/12984.understanding-processor-processor-time-and-process-processor-time

How many cores does your machine have?

Re: Splunk Query for Windows Process Names and CPU Utilizations

Raja_Selvaraj — Thu, 13 Jun 2024 12:15:17 GMT

Thanks for the reply!! Mostly 4 to 8 Cores for Windows Servers..

Re: Splunk Query for Windows Process Names and CPU Utilizations

Raja_Selvaraj — Thu, 13 Jun 2024 12:17:37 GMT

Thanks for the reply!!

The stats i am looking for single windows servers.

| timechart latest('CPU') by process_name host

timechart followed by process_name host does not work