Why is the Windows perfmon data in Splunk for percentage processor time different from the performance counter value on the server?

[shreyasathavale]

I have this Splunk stanza below:

[perfmon://CPUTime]
interval = 30
object = Processor
counters = % Processor Time
instances = _Total
disabled = 0
index = perfmon

When I run this search, I get a result of around 50+%

index = perfmon ( datacenter="iad" ) ( environment="prod" ) ( host="ms10191" ) ( counter="% Processor Time" ) ( instance="_Total" ) | eval name=host+"-"+counter+"-"+instance | timechart avg(Value) by name

But when I check through the Performance Counter on the server, I am getting a value around 15-20%

Is splunk showing wrong data?

[s2_splunk]

Are the time spans that you are averaging over in your Splunk search the same than the sampling periods configured in Perfmon for your Windows hosts? If those don't match, one would expect the results to be different, no? Note that you are pulling Perfmon data every 30 seconds.

[bpitts2]

I know this is old, but I was hoping you may have found an answer. I'm also observing different returned values in splunk than what is in perfmon local to the server.