cpu utilization

[vaibhavbeohar]

Hi

while seeing CPU utilization of my server in spunk, i am getting following fields, can you please explain

sourcetype="Perfmon:CPU Load"
collection="CPU Load"
object=Processor
counter="% User Time"
instance=_Total
Value=0.029156509359650525

what is the meaning of Value in terms of CPU utilization.
and also can you please help me out to write search to get CPU utilization with host name in my clustered servers

Many Thanks in advance.

Thanks.

[kristian_kolb]

To convert the value of Value (0.02931234123) to 2.9;

   ...| eval newValue=round(Value * 100,1)

To convert the value of Value (0.02931234123) to 2.93;

   ...| eval newValue=round(Value * 100,2)

To change it into a string ('2.93 %') as well:

   ...| eval newValue=round(Value * 100,2) . " %"

Hope this helps,

Kristian

[Drainy]

As per; http://msdn.microsoft.com/en-us/library/ms178072.aspx
% User Time is the time the CPU spends on user run processes. In your case it is a tiny amount but you probably want to look at % Processor Time (have a look here)

Once you have that data you can do some searches to look at utilization but you would need to be more specific for what you want to see.
Have a look at the Windows for Splunk app to get some decent OTB dashboards, which is here.

[vaibhavbeohar]

Hi, Please help me to write search to get cpu utilization in percentage

[vaibhavbeohar]

Ok .. I am getting some data via universal forwarder .. i just need a simple search to check cpu utilization in percentage in my remote machine.

Thanks

[Drainy]

I believe it is the user time in percent, where 1 is 100%

[vaibhavbeohar]

Thanks for your reply...my concern is about value , what does this Value=0.029156509359650525 means???