PerfmonMk:CPU underreports _Total %_Processor_Time

[gregorymountfor]

I track the overall CPU usage on a server with:

index=mcadth_metrics host=IS20_DB sourcetype=PerfmonMk:CPU instance=_Total

And it works well for all other servers, and for this server until it went down for a reboot about 10 days ago.

The server's average CPU load (%_Processor_Time) is usually around 40%, but has been reporting in Splunk at about 5% since the reboot.

No config was changed over the time of the reboot; and the Splunk forwarder has been restarted with no change.

Image below shows Splunk search for %_Processor_Time returning with an Average of 5.35%.

gregorymountfor_0-1628863810242.png

Image below shows actual server metrics reporting at 41% utilization.

gregorymountfor_1-1628863943750.png