Getting Data In

Why is the Windows perfmon data in Splunk for percentage processor time different from the performance counter value on the server?


I have this Splunk stanza below:

interval = 30
object = Processor
counters = % Processor Time
instances = _Total
disabled = 0
index = perfmon

When I run this search, I get a result of around 50+%

index = perfmon ( datacenter="iad" ) ( environment="prod" ) ( host="ms10191" ) ( counter="% Processor Time" ) ( instance="_Total" ) | eval name=host+"-"+counter+"-"+instance | timechart avg(Value) by name

But when I check through the Performance Counter on the server, I am getting a value around 15-20%

Is splunk showing wrong data?

Tags (3)

Splunk Employee
Splunk Employee

Are the time spans that you are averaging over in your Splunk search the same than the sampling periods configured in Perfmon for your Windows hosts? If those don't match, one would expect the results to be different, no? Note that you are pulling Perfmon data every 30 seconds.

0 Karma

Path Finder

I know this is old, but I was hoping you may have found an answer. I'm also observing different returned values in splunk than what is in perfmon local to the server.

0 Karma
Get Updates on the Splunk Community!

Build Scalable Security While Moving to Cloud - Guide From Clayton Homes

 Clayton Homes faced the increased challenge of strengthening their security posture as they went through ...

Mission Control | Explore the latest release of Splunk Mission Control (2.3)

We’re happy to announce the release of Mission Control 2.3 which includes several new and exciting features ...

Cloud Platform | Migrating your Splunk Cloud deployment to Python 3.7

Python 2.7, the last release of Python 2, reached End of Life back on January 1, 2020. As part of our larger ...