Monitoring Splunk

How can I calculate per host CPU utilization in a report?

JyotiP
Path Finder

host=test01 index="perfmon" collection="CPU" counter="% Processor Time" | bucket _time span=15m | stats avg(Value) as avg_CPU by _time | where avg_CPU>=60

The above query is giving me the CPU utilization above 60% with the span of 15 minute. But I have 9 host like aeperf01,aeperf02,aeperf03 and so on. I want to calculate per host how can I do it ??

Tags (2)
0 Karma

richgalloway
SplunkTrust
SplunkTrust

Try something like this. It will show the current Value for each host.

host=aeperf* index="perfmon" collection="CPU" counter="% Processor Time" | bucket _time span=15m | stats avg(Value) as avg_CPU by host | where avg_CPU>=60

If you want to see the Value over time, try this.

host=aeperf* index="perfmon" collection="CPU" counter="% Processor Time" | bucket _time span=15m | timechar avg(Value) as avg_CPU by host | where avg_CPU>=60
---
If this reply helps you, Karma would be appreciated.
0 Karma
Get Updates on the Splunk Community!

Your Guide to Splunk Digital Experience Monitoring

A flawless digital experience isn't just an advantage, it's key to customer loyalty and business success. But ...

Data Management Digest – November 2025

  Welcome to the inaugural edition of Data Management Digest! As your trusted partner in data innovation, the ...

Upcoming Webinar: Unmasking Insider Threats with Slunk Enterprise Security’s UEBA

Join us on Wed, Dec 10. at 10AM PST / 1PM EST for a live webinar and demo with Splunk experts! Discover how ...