I track the overall CPU usage on a server with:
index=mcadth_metrics host=IS20_DB sourcetype=PerfmonMk:CPU instance=_Total
And it works well for all other servers, and for this server until it went down for a reboot about 10 days ago.
The server's average CPU load (%_Processor_Time) is usually around 40%, but has been reporting in Splunk at about 5% since the reboot.
No config was changed over the time of the reboot; and the Splunk forwarder has been restarted with no change.
Image below shows Splunk search for %_Processor_Time returning with an Average of 5.35%.
Image below shows actual server metrics reporting at 41% utilization.
