How to write a search query to list top 3 cpu consuming windows processes per host?

[manmah4u]

Hi,

I have around 100 windows hosts monitored by splunk server(6.0.1). I'm struggling to find a query which would list top 3 windows process consuming high cpu usage. I'm able to view all windows process host wise which is not my requirement. Top filter doesn't help as it lists top 3 processes among all host. I need top 3 process for every host. The query m using is as below.

earliest=-15m environment=prod source="Perfmon:Process"  counter="% Processor Time"   | where (instance!="_Total" AND instance!="Idle" AND instance!="System") | stats avg(Value) by host,instance

Thanks,

[somesoni2 · Accepted solution]

Give this a try

earliest=-15m environment=prod source="Perfmon:Process"  counter="% Processor Time"  (instance!="_Total" AND instance!="Idle" AND instance!="System") | stats avg(Value) as AvgValue by host,instance | sort 0 -host,-AvgValue 
| streamstats count as sno by host | where sno>4 | fields - sno

The streamstats (after sort) will generate rank for AvgValue for each host and where clause will filter to leave only the top 3 AvgValue per host.

[manmah4u]

Thanks It works.

[HiroshiSatoh]

Try this!

(your search)|sort host - avg(Value) |dedup 3 host

[tom_frotscher]

Hi!

You can try to sort the search results by your processor time field and then show only the first 3 results with the head command. Should be something like this:

... | sort - "%Processor Time" | head 3

If your goal is to first calculate the average, like in your posted search query, then:

earliest=-15m environment=prod source="Perfmon:Process" counter="% Processor Time" | where (instance!="_Total" AND instance!="Idle" AND instance!="System") | stats avg(Value) as cputime by host,instance | sort - cputime | head 3