Getting Data In

PerfmonMk:CPU underreports _Total %_Processor_Time


I track the overall CPU usage on a server with:



index=mcadth_metrics host=IS20_DB sourcetype=PerfmonMk:CPU instance=_Total



And it works well for all other servers, and for this server until it went down for a reboot about 10 days ago.


The server's average CPU load (%_Processor_Time) is usually around 40%, but has been reporting in Splunk at about 5% since the reboot.

No config was changed over the time of the reboot; and the Splunk forwarder has been restarted with no change.

Image below shows Splunk search for %_Processor_Time returning with an Average of 5.35%.


Image below shows actual server metrics reporting at 41% utilization.




Labels (1)
0 Karma
Get Updates on the Splunk Community!

.conf24 | Day 0

Hello Splunk Community! My name is Chris, and I'm based in Canberra, Australia's capital, and I travelled for ...

Enhance Security Visibility with Splunk Enterprise Security 7.1 through Threat ...

 (view in My Videos)Struggling with alert fatigue, lack of context, and prioritization around security ...

Troubleshooting the OpenTelemetry Collector

  In this tech talk, you’ll learn how to troubleshoot the OpenTelemetry collector - from checking the ...