Splunk Dev

What is pctIdle in splunk index os?

Shashank_87
Explorer

Hi,

What is this field pctIdle which automatically gets extracted when we use multikv command?
Is it the avg cpu load?
Is it the percentage of time when CPU was idle?
If i need to calculate the CPU utilisation % of my 2 host, which query and sourcetype should i use from the below 2 queries?

1. index=os sourcetype=top host="host1" OR host="host2" 
| timechart span=5m values(pctCPU) by host

2.index=os sourcetype=cpu host="host1" OR host="host2" 
| eval Percent_CPU_Load = 100 - pctIdle 
| timechart avg(Percent_CPU_Load) by host

Appreciate if someone can help

Tags (1)
1 Solution

renjith_nair
SplunkTrust
SplunkTrust

@Shashank_87,

pctIdle or Percent Idle Time is percentage of time that the CPU or CPUs were idle and the system did not have an outstanding disk I/O request. Have a look at this to see a comparison of commands used : https://www.cyberciti.biz/tips/how-do-i-find-out-linux-cpu-utilization.html

If you need to calculate CPU utilisation % of hosts, use eval Percent_CPU_Usage = 100 - pctIdle , see Percent_CPU_Usage

On another note, do you have pctCPU field? As far as I have seen, the headers for CPU utilization are

CPU    pctUser    pctNice  pctSystem  pctIowait    pctIdle

Which are

CPU : CPU number

%user: Percentage of CPU utilization that occurred while executing at the user level (application).

%nice: Percentage of CPU utilization that occurred while executing at the user level with nice priority.

%system: Percentage of CPU utilization that occurred while executing at the system level (kernel).

%iowait: Percentage of time that the CPU or CPUs were idle during which the system had an outstanding disk I/O request.

%idle: Percentage of time that the CPU or CPUs were idle and the system did not have an outstanding disk I/O request.
Happy Splunking!

View solution in original post

renjith_nair
SplunkTrust
SplunkTrust

@Shashank_87,

pctIdle or Percent Idle Time is percentage of time that the CPU or CPUs were idle and the system did not have an outstanding disk I/O request. Have a look at this to see a comparison of commands used : https://www.cyberciti.biz/tips/how-do-i-find-out-linux-cpu-utilization.html

If you need to calculate CPU utilisation % of hosts, use eval Percent_CPU_Usage = 100 - pctIdle , see Percent_CPU_Usage

On another note, do you have pctCPU field? As far as I have seen, the headers for CPU utilization are

CPU    pctUser    pctNice  pctSystem  pctIowait    pctIdle

Which are

CPU : CPU number

%user: Percentage of CPU utilization that occurred while executing at the user level (application).

%nice: Percentage of CPU utilization that occurred while executing at the user level with nice priority.

%system: Percentage of CPU utilization that occurred while executing at the system level (kernel).

%iowait: Percentage of time that the CPU or CPUs were idle during which the system had an outstanding disk I/O request.

%idle: Percentage of time that the CPU or CPUs were idle and the system did not have an outstanding disk I/O request.
Happy Splunking!

Shashank_87
Explorer

Brilliant Thank you

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...