Splunk Search

How to capture CPU Load Average shown in Windows Task manager in Splunk

New Member

I am trying to create a report to capture overall CPU Load average. I have created a search query in splunk using perfmon counter but that does not represent the overall CPU load as using individual counters give separate values. I want to capture overall CPU load as displayed in Windows Task Manager. Please help to provide a search query for overall CPU usage.

I am using the below search query :

host="*" source="Perfmon:Processor" counter="% Processor Time" instance="_Total" object="Processor" | bucket _time span=1d | chart limit=0 avg(Value) over _time by host | eval Time=_time | convert timeformat="%d-%b %H:%M:%S" ctime(Time) |fields - _time|table Time, *

0 Karma
Did you miss .conf21 Virtual?

Good news! The event's keynotes and many of its breakout sessions are now available online, and still totally FREE!