Splunk Search

CPU Perfmon Averages by Host


I'm trying to list all hosts that breach a set threshold average on CPU load. Here is my query which returns no results:

index=sandbox sourcetype="Perfmon:CPU Load"|stats avg(Value) as AVGValue |where AVGValue > 0 | stats count by host

If I remove the |stats avg(Value) as AVGValue | and simply do |where Value > 0 | stats count by host I'm able to get results.

0 Karma


Add a by host to the first stats.

Take the 2021 Splunk Career Survey

Help us learn about how Splunk has
impacted your career by taking the 2021 Splunk Career Survey.

Earn $50 in Amazon cash!