Monitoring Splunk

How can I calculate per host CPU utilization in a report?

JyotiP
Path Finder

host=test01 index="perfmon" collection="CPU" counter="% Processor Time" | bucket _time span=15m | stats avg(Value) as avg_CPU by _time | where avg_CPU>=60

The above query is giving me the CPU utilization above 60% with the span of 15 minute. But I have 9 host like aeperf01,aeperf02,aeperf03 and so on. I want to calculate per host how can I do it ??

Tags (2)
0 Karma

richgalloway
SplunkTrust
SplunkTrust

Try something like this. It will show the current Value for each host.

host=aeperf* index="perfmon" collection="CPU" counter="% Processor Time" | bucket _time span=15m | stats avg(Value) as avg_CPU by host | where avg_CPU>=60

If you want to see the Value over time, try this.

host=aeperf* index="perfmon" collection="CPU" counter="% Processor Time" | bucket _time span=15m | timechar avg(Value) as avg_CPU by host | where avg_CPU>=60
---
If this reply helps you, Karma would be appreciated.
0 Karma
Get Updates on the Splunk Community!

Automatic Discovery Part 1: What is Automatic Discovery in Splunk Observability Cloud ...

If you’ve ever deployed a new database cluster, spun up a caching layer, or added a load balancer, you know it ...

Real-Time Fraud Detection: How Splunk Dashboards Protect Financial Institutions

Financial fraud isn't slowing down. If anything, it's getting more sophisticated. Account takeovers, credit ...

Splunk + ThousandEyes: Correlate frontend, app, and network data to troubleshoot ...

 Are you tired of troubleshooting delays caused by siloed frontend, application, and network data? We've got a ...