WinHostMon://Processor is indexing the wrong ClockSpeedMHz....any thoughts

[lycollicott]

server01 is a physical server with two 6 core CPUs which are 3.4 Ghz.

This query:

`techinventory_indexes` tag=inventory host=server01 | fields tinv_cpu_*, host

Returns these two results

Type=Processor
Name="Intel(R) Xeon(R) CPU E5-2643 v3 @ 3.40GHz"
Manufacturer="GenuineIntel"
Architecture="x64"
ClockSpeedMHz=1800
NumberOfCores=6
NumberOfProcessors=12
Processor Id="BFEBFBFF000306F2"

Type=Processor
Name="Intel(R) Xeon(R) CPU E5-2643 v3 @ 3.40GHz"
Manufacturer="GenuineIntel"
Architecture="x64"
ClockSpeedMHz=1200
NumberOfCores=6
NumberOfProcessors=12
Processor Id="BFEBFBFF000306F2"

How is the WinHostMon://Processor modular input determining ClockSpeedMHz and why is it wrong? I would like to use the data along with Technology Inventory Add-on for Splunk to run inventory reports, but this doesn't look good.

[martin_mueller · Accepted solution]

Looks like the cores are clocked down automatically to save power when not loaded up a lot.
Here's my home Splunk under load:

Type=Processor
Name="AMD Ryzen 7 1700X Eight-Core Processor         "
Manufacturer="AuthenticAMD"
Architecture="x64"
ClockSpeedMHz=3400
NumberOfCores=8
NumberOfProcessors=16

and here it is under less load:

Type=Processor
Name="AMD Ryzen 7 1700X Eight-Core Processor "
 Manufacturer="AuthenticAMD"
Architecture="x64"
ClockSpeedMHz=2200
NumberOfCores=8
NumberOfProcessors=16

I'd say it's reporting the current clock speed accurately.