Splunk Search
Highlighted

CPU Utilization Query

New Member

I am using this query to Fetch CPU Utilization details

index=os sourcetype="cpu" | multikv forceheader=1 | eval humanreadabletime=strftime(time, "%Y-%d-%m %H:%M:%S") | eval percentageCPUUtil = 100 - pctIdle | table humanreadable_time,host,percentageCPUUtil,pctIdle

But for particular time and for the same host , we are getting multiple rows, Below is the ouput

humanreadabletime,host,percentageCPUUtil,pctIdle
2012-19-03 03:44:58,edb1crsapppex45,2.16,97.84
2012-19-03 03:44:58,edb1crsapppex45,1.00,99.00
2012-19-03 03:44:58,edb1crsapppex45,0.99,99.01
2012-19-03 03:44:58,edb1crsapppex45,0.00,100.00
2012-19-03 03:44:58,edb1crsapppex45,0.00,100.00
2012-19-03 03:44:58,edb1crsapppex45,0.00,100.00
2012-19-03 03:44:58,edb1crsapppex45,0.00,100.00
2012-19-03 03:44:58,edb1crsapppex45,0.00,100.00
2012-19-03 03:44:58,edb1crsapppex45,5.94,94.06
2012-19-03 03:44:58,edb1crsapppex45,2.00,98.00
2012-19-03 03:44:58,edb1crsapppex45,0.00,100.00
2012-19-03 03:44:58,edb1crsapppex45,0.00,100.00
2012-19-03 03:44:58,edb1crsapppex45,0.00,100.00
2012-19-03 03:44:58,edb1crsapppex45,1.98,98.02
2012-19-03 03:44:58,edb1crsapppex45,0.00,100.00
2012-19-03 03:44:58,edb1crsapppex45,3.00,97.00
2012-19-03 03:44:58,edb1crsapppex45,0.00,100.00
2012-19-03 03:44:58,edb1crsapppex45,9.00,91.00
2012-19-03 03:44:58,edb1crsapppex45,0.00,100.00
2012-19-03 03:44:58,edb1crsapppex45,0.00,100.00
2012-19-03 03:44:58,edb1crsapppex45,28.00,72.00
2012-19-03 03:44:58,edb1crsapppex45,0.00,100.00
2012-19-03 03:44:58,edb1crsapppex45,0.00,100.00
2012-19-03 03:44:58,edb1crsapppex45,0.00,100.00
2012-19-03 03:44:58,edb1crsapppex45,0.00,100.00

If we notice the output, for the same time and same host, we are getting multiple Rows. So which row should be assume is the Percentage CPU Utilization.

But if we add | search CPU=all | in the query, then output we are getting is fine.

Kindly Suggest.

Tags (1)
0 Karma
Highlighted

Re: CPU Utilization Query

Path Finder

Probably your host has a multicore CPU or several CPUs so in this case you have utilization for each core. Like a solution you can add core number to output and calculate utilization for each core or calculate average value of all rows or use just CPU=all

0 Karma
Highlighted

Re: CPU Utilization Query

Path Finder

Use Monitoring Console builtin since Splunk 6.5. It is a great feature.

https://docs.splunk.com/Documentation/Splunk/7.0.0/DMC/DMCoverview

0 Karma