https://community.splunk.com/t5/Splunk-Search/Query-to-display-average-cpu-usage-for-all-splunk-search-heads/m-p/207690#M60539 <P>Thank @somesoni2</P> Fri, 23 Sep 2016 20:17:14 GMT jward6004 2016-09-23T20:17:14Z https://community.splunk.com/t5/Splunk-Search/Query-to-display-average-cpu-usage-for-all-splunk-search-heads/m-p/207688#M60537 <P>I'm building reporting for capacity planning to improve the performance across our splunk environment. During my company's peak period of year, our indexers CPU gets pegged and I'd like to query for that date range to display this activity. I've been trying out a few different queries but I have no been able to get quite what I'm looking for. </P> <P>index=main host=splunk* source="Perfmon:CPU" counter="% Processor Time" | stats avg(Value) as "CPU Processor Time" by host</P> <P>Can anyone also help me gather the avg &gt; 75% cpu processor time?</P> Fri, 23 Sep 2016 18:59:01 GMT https://community.splunk.com/t5/Splunk-Search/Query-to-display-average-cpu-usage-for-all-splunk-search-heads/m-p/207688#M60537 jward6004 2016-09-23T18:59:01Z https://community.splunk.com/t5/Splunk-Search/Query-to-display-average-cpu-usage-for-all-splunk-search-heads/m-p/207689#M60538 <P>How about this</P> <PRE><CODE>index=main host=splunk* source="Perfmon:CPU" counter="% Processor Time" | bucket span=1d _time | stats avg(Value) as avgcpu by _time host | where avgcpu&gt;75.0| timechart span=1d avg(avgcpu) as "CPU Processor Time" by host limit=0 </CODE></PRE> Fri, 23 Sep 2016 19:19:24 GMT https://community.splunk.com/t5/Splunk-Search/Query-to-display-average-cpu-usage-for-all-splunk-search-heads/m-p/207689#M60538 somesoni2 2016-09-23T19:19:24Z https://community.splunk.com/t5/Splunk-Search/Query-to-display-average-cpu-usage-for-all-splunk-search-heads/m-p/207690#M60539 <P>Thank @somesoni2</P> Fri, 23 Sep 2016 20:17:14 GMT https://community.splunk.com/t5/Splunk-Search/Query-to-display-average-cpu-usage-for-all-splunk-search-heads/m-p/207690#M60539 jward6004 2016-09-23T20:17:14Z