How to threshold Processor Queue Length in Splunk ITSI?

[Kendo213]

How are you guys thresholding Processor Queue Length in ITSI? ITSI by default has static thresholds that don't necessarily make sense.

Normal: 0-1, Medium: 2-5, High: >5

Information I've read states that if the processor queue length is twice the number of cores it should be a concern. If a system has 16 cores and 5 processor queue length, I wouldn't think that would be an issue based on information I've read.

[yannK]

It sounds like a Microsoft admin question.
Those data seem to be from a windows forwarder monitoring, but microsoft explains that the number depends of the number of cores.

Microsoft® Description – Processor Queue Length is the number of threads in the processor queue. Unlike the disk counters, this counter counters, this counter shows ready threads only, not threads that are running. There is a single queue for processor time even on computers with multiple processors. Therefore, if a computer has multiple processors, you need to divide this value by the number of processors servicing the workload. A sustained processor queue of less than 10 threads per processor is normally acceptable, dependent of the workload.

Maybe you could use an more complex KPI search to also compare the number of cores, and normalize your metric.