I am new to Splunk.
I have tried to add CPU data locally in Splunk, and I am able to get data core-wise but I need average CPU utilization. How I can do this?
04/27/2020 23:09:19.414 +0530
11:09:19.414 PM
collection=cpu12
object="TCPIP Performance Diagnostics (Per-CPU)"
counter="TCP current connections"
instance=CPU3
Value=7
Collapse
host = *
source = Perfmon:cpu12
sourcetype = Perfmon:cpu12
04/27/2020 23:09:19.414 +0530
11:09:19.414 PM
collection=cpu12
object="TCPIP Performance Diagnostics (Per-CPU)"
counter="TCP current connections"
instance=CPU2
Value=6
Collapse
host = *
source = Perfmon:cpu12
sourcetype = Perfmon:cpu12
04/27/2020 23:09:19.414 +0530
11:09:19.414 PM
collection=cpu12
object="TCPIP Performance Diagnostics (Per-CPU)"
counter="TCP current connections"
instance=CPU1
Value=7
Collapse
host = *
source = Perfmon:cpu12
sourcetype = Perfmon:cpu12
04/27/2020 23:09:19.414 +0530
11:09:19.414 PM
collection=cpu12
object="TCPIP Performance Diagnostics (Per-CPU)"
counter="TCP current connections"
instance=CPU0
Value=8
Collapse
host = *
source = Perfmon:cpu12
sourcetype = Perfmon:cpu12
thanks
First, you need to be regularly ingesting that data. connections is not CPU utilization, usually, but let's suppose it was.
Then, you do this -
Your search that gets just those events across time
| stats avg(Value) as Value by host instance
That gets you the average for each instance. Then you average again across instances
| stats avg(Value) as Value by host
However, depending on your monitoring software, there may also be another record there that contains the overall host information, regardless of instance. Check for that first.