All Apps and Add-ons

There is a problem with multi processor machines, and the number of cores and Number of processors in the host information page.



On windows machines with 2 or more cpu slots, the hostmon will return an event pr. slot. as seen by the following screenshot:alt text

The problem is the way the search handles this, as it just makes a dedup by host:

{% searchmanager
search='eventtype=hostmon_windows Type=OperatingSystem host="$Host$" | dedup host | eval OSArchitecture=Architecture | join host [search eventtype=hostmon_windows Type=Computer host="$Host$" | dedup host | eval ComputerManufacturer=Manufacturer] | join host [search eventtype=hostmon_windows Type=Processor host="$Host$" | dedup host]'|token_safe

This will result in a grand total of 8 cores, not the 32, that actually is on the host.

kind regards


0 Karma


try this search :
eventtype=hostmon_windows Type=OperatingSystem host="$Host$" | eval OSArchitecture=Architecture | eval ComputerManufacturer=Manufacturer |eval number_of_cores=NumberofCore |eval Number_of_processors=NumberofProcessors

or you use appendcols command because join command is no approprie to this context.

0 Karma


I agree with your notion, that it doesn't work, personally I considered using an eventstats, and still join the three types together.
What is more important is, that the query I pasted in the original question is used in the html, that is shipped with the app, so hopefully the guys working on Splunk app for windows infrastructure will see the post, so it might be corrected in the future, and until then its a head up, that Host Information might be incorrect in some cases.

0 Karma
.conf21 Now Fully Virtual!
Register for FREE Today!

We've made .conf21 totally virtual and totally FREE! Our completely online experience will run from 10/19 through 10/20 with some additional events, too!