CPU Utilization Query

[kuldeepsingh99]

I am using this query to Fetch CPU Utilization details

index=os sourcetype="cpu" | multikv forceheader=1 | eval human_readable_time=strftime(_time, "%Y-%d-%m %H:%M:%S") | eval percentageCPUUtil = 100 - pctIdle | table human_readable_time,host,percentageCPUUtil,pctIdle

But for particular time and for the same host , we are getting multiple rows, Below is the ouput

human_readable_time,host,percentageCPUUtil,pctIdle
2012-19-03 03:44:58,edb1crsapppex45,2.16,97.84
2012-19-03 03:44:58,edb1crsapppex45,1.00,99.00
2012-19-03 03:44:58,edb1crsapppex45,0.99,99.01
2012-19-03 03:44:58,edb1crsapppex45,0.00,100.00
2012-19-03 03:44:58,edb1crsapppex45,0.00,100.00
2012-19-03 03:44:58,edb1crsapppex45,0.00,100.00
2012-19-03 03:44:58,edb1crsapppex45,0.00,100.00
2012-19-03 03:44:58,edb1crsapppex45,0.00,100.00
2012-19-03 03:44:58,edb1crsapppex45,5.94,94.06
2012-19-03 03:44:58,edb1crsapppex45,2.00,98.00
2012-19-03 03:44:58,edb1crsapppex45,0.00,100.00
2012-19-03 03:44:58,edb1crsapppex45,0.00,100.00
2012-19-03 03:44:58,edb1crsapppex45,0.00,100.00
2012-19-03 03:44:58,edb1crsapppex45,1.98,98.02
2012-19-03 03:44:58,edb1crsapppex45,0.00,100.00
2012-19-03 03:44:58,edb1crsapppex45,3.00,97.00
2012-19-03 03:44:58,edb1crsapppex45,0.00,100.00
2012-19-03 03:44:58,edb1crsapppex45,9.00,91.00
2012-19-03 03:44:58,edb1crsapppex45,0.00,100.00
2012-19-03 03:44:58,edb1crsapppex45,0.00,100.00
2012-19-03 03:44:58,edb1crsapppex45,28.00,72.00
2012-19-03 03:44:58,edb1crsapppex45,0.00,100.00
2012-19-03 03:44:58,edb1crsapppex45,0.00,100.00
2012-19-03 03:44:58,edb1crsapppex45,0.00,100.00
2012-19-03 03:44:58,edb1crsapppex45,0.00,100.00

If we notice the output, for the same time and same host, we are getting multiple Rows. So which row should be assume is the Percentage CPU Utilization.

But if we add | search CPU=all | in the query, then output we are getting is fine.

Kindly Suggest.

[jrprez1804]

Use Monitoring Console builtin since Splunk 6.5. It is a great feature.

https://docs.splunk.com/Documentation/Splunk/7.0.0/DMC/DMCoverview

[Vladimir]

Probably your host has a multicore CPU or several CPUs so in this case you have utilization for each core. Like a solution you can add core number to output and calculate utilization for each core or calculate average value of all rows or use just CPU=all