Splunk Search

Display the process that has top %_Processor_Time usage.

vaishnavi07
Explorer

How to display the top 10 Processes that has high %_Processor_Time.

index=winserver_process sourcetype="PerfmonMk:RunningProcesses" NOT instance=Idle NOT instance=_Total earliest=-5m@m | eval Process=upper(instance) | top Process limit=10

What does this "top Process" command do? how to find the process that has high %_Processor_Time utilization?

Does anyone know the answer? Thanks in advance!

Tags (1)
0 Karma

jameshgibson
Path Finder

You first need to sort the processes by %_Processor_time before using top. Something like

| sort - %_Processor_Time | top Process limit=10

The top command just gives you the first 10 lines of the results.

0 Karma
Get Updates on the Splunk Community!

Enterprise Security Content Update (ESCU) | New Releases

In the last month, the Splunk Threat Research Team (STRT) has had 2 releases of new security content via the ...

Announcing the 1st Round Champion’s Tribute Winners of the Great Resilience Quest

We are happy to announce the 20 lucky questers who are selected to be the first round of Champion's Tribute ...

We’ve Got Education Validation!

Are you feeling it? All the career-boosting benefits of up-skilling with Splunk? It’s not just a feeling, it's ...