Getting Data In

Why is the Windows perfmon data in Splunk for percentage processor time different from the performance counter value on the server?


I have this Splunk stanza below:

interval = 30
object = Processor
counters = % Processor Time
instances = _Total
disabled = 0
index = perfmon

When I run this search, I get a result of around 50+%

index = perfmon ( datacenter="iad" ) ( environment="prod" ) ( host="ms10191" ) ( counter="% Processor Time" ) ( instance="_Total" ) | eval name=host+"-"+counter+"-"+instance | timechart avg(Value) by name

But when I check through the Performance Counter on the server, I am getting a value around 15-20%

Is splunk showing wrong data?

Tags (3)

Splunk Employee
Splunk Employee

Are the time spans that you are averaging over in your Splunk search the same than the sampling periods configured in Perfmon for your Windows hosts? If those don't match, one would expect the results to be different, no? Note that you are pulling Perfmon data every 30 seconds.

0 Karma

Path Finder

I know this is old, but I was hoping you may have found an answer. I'm also observing different returned values in splunk than what is in perfmon local to the server.

0 Karma
.conf21 Now Fully Virtual!
Register for FREE Today!

We've made .conf21 totally virtual and totally FREE! Our completely online experience will run from 10/19 through 10/20 with some additional events, too!