CPU Utilization of Splunk Forwarder running on Linux machine showing wrong values

[hishamjan]

Hi,

I have two servers running on Centos that have Universal Forwarder installed and I've enabled the following:

hishamjan_0-1617036544932.png

But using htop command on the servers, the CPU utilization is almost 100% but on splunk, it shows 20-30% at most.

Below is the query I used to find the CPU utilization for each available host:

host=* source="vmstat" | bucket span=300s _time | stats max(memUsedPct) as memUsedPct by _time host |  timechart span=300s max(memUsedPct) as "Used Memory Percentage" by host limit=0

Please, is there a way to resonate with the htop results?

[s2_splunk]

You are asking about CPU utilization, but your search query is using memUsedPct (memory)....?

[hishamjan]

hishamjan_0-1617043739633.png

this is the visualization of different hosts using the above query.

Hope this also gives you a better idea of what I'm achieving vs what I really wanna achieve.

[hishamjan]

Hi, 

this is what I was getting in my search results.

please refer to the picture below:

hishamjan_0-1617043311559.png

Hope this gives you an idea about the memUsedPct (memory) I've indexed.