Monitoring Splunk

Multisearch to display Average % CPU Used by Process by Hosts for both linux and windows servers

johnward4
Communicator

I've trying to create a multisearch that displays the Average % CPU Used by Process by Hosts for both Linux and Windows Servers. My Linux query works great but I'm having issues outputting the same for my Windows query. Please help!
Here's my current query :

| multisearch
[ search (index=os host=hostname* source=ps) process_name!="-bash"| stats avg(process_cpu_used_percent) AS avgCPUUsed by process_name, host | where avgCPUUsed > 50 | rename avgCPUUsed AS "% CPU Used by Process" | rename process_name as "Process Name" | sort - "% CPU Used by Process"]
[ search (index=perfmon host=hostname* (source="Perfmon:Process") counter="% Processor Time" (instance!="_Total" AND instance!="Idle" AND instance!="System") | eventstats avg(Value) as AvgValue by host,instance | where AvgValue > 50 | sort -AvgValue]

0 Karma
1 Solution

johnward4
Communicator

Here's how to display CPU load across OS (linux, windows)

|multisearch
[search index=os host=$Hosts$ sourcetype=cpu cpu="all" |eval cpu_used_percent=100-PercentIdleTime]
[search index=perfmon host=$Hosts$ source="Perfmon:CPU" counter="% User Time" OR counter="% Processor Time"
|eval cpu_user_percent=if(counter=="% User Time",round(Value,2),""), cpu_load_percent=if(counter=="% Processor Time",round(Value),""), cpu_used_percent=user_cpu+proc_cpu]
|eval lhost=upper(host)
|bin _time span=10m
|stats avg(cpu_user_percent) as user_cpu, avg(cpu_load_percent) as proc_cpu by host, _time
|stats last(user_cpu) as user_cpu, last(proc_cpu) as proc_cpu, sparkline(avg(user_cpu)) as "% User CPU Load", sparkline(avg(proc_cpu)) as "% Processor CPU Load" by host
|eval user_cpu=round(user_cpu,2), proc_cpu=round(proc_cpu,2)
|rename user_cpu as "% Current User CPU Load", proc_cpu as "% Current Processor Load"
| sort - "% Current User CPU Load"

View solution in original post

0 Karma

johnward4
Communicator

Here's how to display CPU load across OS (linux, windows)

|multisearch
[search index=os host=$Hosts$ sourcetype=cpu cpu="all" |eval cpu_used_percent=100-PercentIdleTime]
[search index=perfmon host=$Hosts$ source="Perfmon:CPU" counter="% User Time" OR counter="% Processor Time"
|eval cpu_user_percent=if(counter=="% User Time",round(Value,2),""), cpu_load_percent=if(counter=="% Processor Time",round(Value),""), cpu_used_percent=user_cpu+proc_cpu]
|eval lhost=upper(host)
|bin _time span=10m
|stats avg(cpu_user_percent) as user_cpu, avg(cpu_load_percent) as proc_cpu by host, _time
|stats last(user_cpu) as user_cpu, last(proc_cpu) as proc_cpu, sparkline(avg(user_cpu)) as "% User CPU Load", sparkline(avg(proc_cpu)) as "% Processor CPU Load" by host
|eval user_cpu=round(user_cpu,2), proc_cpu=round(proc_cpu,2)
|rename user_cpu as "% Current User CPU Load", proc_cpu as "% Current Processor Load"
| sort - "% Current User CPU Load"

0 Karma
Get Updates on the Splunk Community!

Technical Workshop Series: Splunk Data Management and SPL2 | Register here!

Hey, Splunk Community! Ready to take your data management skills to the next level? Join us for a 3-part ...

Spotting Financial Fraud in the Haystack: A Guide to Behavioral Analytics with Splunk

In today's digital financial ecosystem, security teams face an unprecedented challenge. The sheer volume of ...

Solve Problems Faster with New, Smarter AI and Integrations in Splunk Observability

Solve Problems Faster with New, Smarter AI and Integrations in Splunk Observability As businesses scale ...