Hi. I'm testing the *nix TA on a Solaris 10 LDOM. I enabled the cpu.sh in the inputs.conf and I'm getting the data reported per CPU thread. I have 120 CPU threads on my Solaris LDOM that are being reported and there is a CPU=all field. My box is using about 5% CPU used, 95% CPU idle as shown in a top command. When I do a Splunk search I see all 120 threads and an "all" thread with the percent idle. The "all" entry shows percent idle as 99% while thread 0 has like 95% idle which accurately represents the amount of work the actual server is doing.
How would you handle a situation where you wanted to graph how much CPU was used in a time range? I think the 95% idle is accurate from the top command to show for the time range instead of the all value showing 99%. How come the "all" value doesn't show 95% idle?
Search:
index="os" host="hostname" source="cpu"
Thank you for helping me understand how this CPU TA is supposed to work.
