Monitoring Splunk

cpu utilization

vaibhavbeohar
Path Finder

Hi

while seeing CPU utilization of my server in spunk, i am getting following fields, can you please explain

sourcetype="Perfmon:CPU Load"
collection="CPU Load"
object=Processor
counter="% User Time"
instance=_Total
Value=0.029156509359650525

what is the meaning of Value in terms of CPU utilization.
and also can you please help me out to write search to get CPU utilization with host name in my clustered servers

Many Thanks in advance.

Thanks.

Tags (1)
0 Karma

kristian_kolb
Ultra Champion

To convert the value of Value (0.02931234123) to 2.9;

   ...| eval newValue=round(Value * 100,1)

To convert the value of Value (0.02931234123) to 2.93;

   ...| eval newValue=round(Value * 100,2)

To change it into a string ('2.93 %') as well:

   ...| eval newValue=round(Value * 100,2) . " %"

Hope this helps,

Kristian

0 Karma

Drainy
Champion

As per; http://msdn.microsoft.com/en-us/library/ms178072.aspx
% User Time is the time the CPU spends on user run processes. In your case it is a tiny amount but you probably want to look at % Processor Time (have a look here)

Once you have that data you can do some searches to look at utilization but you would need to be more specific for what you want to see.
Have a look at the Windows for Splunk app to get some decent OTB dashboards, which is here.

vaibhavbeohar
Path Finder

Hi, Please help me to write search to get cpu utilization in percentage

0 Karma

vaibhavbeohar
Path Finder

Ok .. I am getting some data via universal forwarder .. i just need a simple search to check cpu utilization in percentage in my remote machine.

Thanks

0 Karma

Drainy
Champion

I believe it is the user time in percent, where 1 is 100%

0 Karma

vaibhavbeohar
Path Finder

Thanks for your reply...my concern is about value , what does this Value=0.029156509359650525 means???

0 Karma
Get Updates on the Splunk Community!

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...