Splunk Enterprise

How to Graph CPU usage of indexers over time?

DEADBEEF
Path Finder

I received this image from support and I would like to create a panel in my dashboard to mimic this information.  How would I go about doing that?  I was trying with the current query, but am not having luck.

 

 

 

index=_introspection data.normalized_pct_cpu=* sourcetype=splunk_resource_usage host=idx*
| stats avg(data.normalized_pct_cpu) AS cpu_usage BY host
| table host cpu_usage

 

 

 


indexer_cpu.png

 

I am using data.normalized_pct_cpu as the docs state that it is Percentage of CPU usage across all cores. 100% is equivalent to all CPU resources on the machine, which seems to be what I want but not sure if that is the best way to go about this.

Labels (2)
0 Karma
1 Solution

ITWhisperer
SplunkTrust
SplunkTrust

Given that you graphic has a time component, perhaps this might work better for you

index=_introspection data.normalized_pct_cpu=* sourcetype=splunk_resource_usage host=idx*
| timechart avg(data.normalized_pct_cpu) AS cpu_usage BY host

View solution in original post

0 Karma

ITWhisperer
SplunkTrust
SplunkTrust

Given that you graphic has a time component, perhaps this might work better for you

index=_introspection data.normalized_pct_cpu=* sourcetype=splunk_resource_usage host=idx*
| timechart avg(data.normalized_pct_cpu) AS cpu_usage BY host
0 Karma
Get Updates on the Splunk Community!

Splunk Observability Cloud’s AI Assistant in Action Series: Analyzing and ...

This is the second post in our Splunk Observability Cloud’s AI Assistant in Action series, in which we look at ...

Elevate Your Organization with Splunk’s Next Platform Evolution

 Thursday, July 10, 2025  |  11AM PDT / 2PM EDT Whether you're managing complex deployments or looking to ...

Splunk Answers Content Calendar, June Edition

Get ready for this week’s post dedicated to Splunk Dashboards! We're celebrating the power of community by ...