Splunk Search

Display the process that has top %_Processor_Time usage.


How to display the top 10 Processes that has high %_Processor_Time.

index=winserver_process sourcetype="PerfmonMk:RunningProcesses" NOT instance=Idle NOT instance=_Total earliest=-5m@m | eval Process=upper(instance) | top Process limit=10

What does this "top Process" command do? how to find the process that has high %_Processor_Time utilization?

Does anyone know the answer? Thanks in advance!

Tags (1)
0 Karma

Path Finder

You first need to sort the processes by %_Processor_time before using top. Something like

| sort - %_Processor_Time | top Process limit=10

The top command just gives you the first 10 lines of the results.

0 Karma
Get Updates on the Splunk Community!

The Great Resilience Quest: 5th Leaderboard Update

The fifth leaderboard update for The Great Resilience Quest is out >> 🏆 Check out the ...

Devesh Logendran, Splunk, and the Singapore Cyber Conquest

At this year’s Splunk University, I had the privilege of chatting with Devesh Logendran, one of the winners in ...

There's No Place Like Chrome and the Splunk Platform

WATCH NOW!Malware. Risky Extensions. Data Exfiltration. End-users are increasingly reliant on browsers to ...