CPU Perfmon Averages by Host - Splunk Community

Splunk Search

I'm trying to list all hosts that breach a set threshold average on CPU load. Here is my query which returns no results:

index=sandbox sourcetype="Perfmon:CPU Load"|stats avg(Value) as AVGValue |where AVGValue > 0 | stats count by host

If I remove the |stats avg(Value) as AVGValue | and simply do |where Value > 0 | stats count by host I'm able to get results.

Add a by host to the first stats.

Get Updates on the Splunk Community!

Automated Threat Analysis: Available in ES Premier

Automated Threat Analysis: Centralize and Accelerate Phishing Investigations in Splunk Enterprise ...

What’s New in Splunk AI: Volume 02

Welcome to the second edition of “What’s New in Splunk AI” where we look at the latest and greatest updates, ...

Best Practices: Splunk auto adjust pipeline queue

When you enable autoAdjustQueue in Splunk, maxSize should be understood as the queue size Splunk starts with ...