How do I measure CPU usage on *nix TA on Solaris box?

[wongea]

Hi. I'm testing the *nix TA on a Solaris 10 LDOM. I enabled the cpu.sh in the inputs.conf and I'm getting the data reported per CPU thread. I have 120 CPU threads on my Solaris LDOM that are being reported and there is a CPU=all field. My box is using about 5% CPU used, 95% CPU idle as shown in a top command. When I do a Splunk search I see all 120 threads and an "all" thread with the percent idle. The "all" entry shows percent idle as 99% while thread 0 has like 95% idle which accurately represents the amount of work the actual server is doing.

How would you handle a situation where you wanted to graph how much CPU was used in a time range? I think the 95% idle is accurate from the top command to show for the time range instead of the all value showing 99%. How come the "all" value doesn't show 95% idle?

Search:
index="os" host="hostname" source="cpu"

Thank you for helping me understand how this CPU TA is supposed to work.

[somesoni2]

The cpu.sh executes mpstat command to get the CPU usage. the "All" entry is more or less average of all theads combined. I use "all" entries only to get the Avg/Max CPU utilization over period.