Splunk Search

CPU Utilization Query

kuldeepsingh99
New Member

I am using this query to Fetch CPU Utilization details

index=os sourcetype="cpu" | multikv forceheader=1 | eval human_readable_time=strftime(_time, "%Y-%d-%m %H:%M:%S") | eval percentageCPUUtil = 100 - pctIdle | table human_readable_time,host,percentageCPUUtil,pctIdle

But for particular time and for the same host , we are getting multiple rows, Below is the ouput

human_readable_time,host,percentageCPUUtil,pctIdle
2012-19-03 03:44:58,edb1crsapppex45,2.16,97.84
2012-19-03 03:44:58,edb1crsapppex45,1.00,99.00
2012-19-03 03:44:58,edb1crsapppex45,0.99,99.01
2012-19-03 03:44:58,edb1crsapppex45,0.00,100.00
2012-19-03 03:44:58,edb1crsapppex45,0.00,100.00
2012-19-03 03:44:58,edb1crsapppex45,0.00,100.00
2012-19-03 03:44:58,edb1crsapppex45,0.00,100.00
2012-19-03 03:44:58,edb1crsapppex45,0.00,100.00
2012-19-03 03:44:58,edb1crsapppex45,5.94,94.06
2012-19-03 03:44:58,edb1crsapppex45,2.00,98.00
2012-19-03 03:44:58,edb1crsapppex45,0.00,100.00
2012-19-03 03:44:58,edb1crsapppex45,0.00,100.00
2012-19-03 03:44:58,edb1crsapppex45,0.00,100.00
2012-19-03 03:44:58,edb1crsapppex45,1.98,98.02
2012-19-03 03:44:58,edb1crsapppex45,0.00,100.00
2012-19-03 03:44:58,edb1crsapppex45,3.00,97.00
2012-19-03 03:44:58,edb1crsapppex45,0.00,100.00
2012-19-03 03:44:58,edb1crsapppex45,9.00,91.00
2012-19-03 03:44:58,edb1crsapppex45,0.00,100.00
2012-19-03 03:44:58,edb1crsapppex45,0.00,100.00
2012-19-03 03:44:58,edb1crsapppex45,28.00,72.00
2012-19-03 03:44:58,edb1crsapppex45,0.00,100.00
2012-19-03 03:44:58,edb1crsapppex45,0.00,100.00
2012-19-03 03:44:58,edb1crsapppex45,0.00,100.00
2012-19-03 03:44:58,edb1crsapppex45,0.00,100.00

If we notice the output, for the same time and same host, we are getting multiple Rows. So which row should be assume is the Percentage CPU Utilization.

But if we add | search CPU=all | in the query, then output we are getting is fine.

Kindly Suggest.

Tags (1)
0 Karma

jrprez1804
Path Finder

Use Monitoring Console builtin since Splunk 6.5. It is a great feature.

https://docs.splunk.com/Documentation/Splunk/7.0.0/DMC/DMCoverview

0 Karma

Vladimir
Path Finder

Probably your host has a multicore CPU or several CPUs so in this case you have utilization for each core. Like a solution you can add core number to output and calculate utilization for each core or calculate average value of all rows or use just CPU=all

0 Karma
Get Updates on the Splunk Community!

Introducing the Splunk Community Dashboard Challenge!

Welcome to Splunk Community Dashboard Challenge! This is your chance to showcase your skills in creating ...

Get the T-shirt to Prove You Survived Splunk University Bootcamp

As if Splunk University, in Las Vegas, in-person, with three days of bootcamps and labs weren’t enough, now ...

Wondering How to Build Resiliency in the Cloud?

IT leaders are choosing Splunk Cloud as an ideal cloud transformation platform to drive business resilience,  ...