Splunk Search

How to write a search query to list top 3 cpu consuming windows processes per host?

manmah4u
Explorer

Hi,

I have around 100 windows hosts monitored by splunk server(6.0.1). I'm struggling to find a query which would list top 3 windows process consuming high cpu usage. I'm able to view all windows process host wise which is not my requirement. Top filter doesn't help as it lists top 3 processes among all host. I need top 3 process for every host. The query m using is as below.

earliest=-15m environment=prod source="Perfmon:Process"  counter="% Processor Time"   | where (instance!="_Total" AND instance!="Idle" AND instance!="System") | stats avg(Value) by host,instance

Thanks,

1 Solution

somesoni2
SplunkTrust
SplunkTrust

Give this a try

earliest=-15m environment=prod source="Perfmon:Process"  counter="% Processor Time"  (instance!="_Total" AND instance!="Idle" AND instance!="System") | stats avg(Value) as AvgValue by host,instance | sort 0 -host,-AvgValue 
| streamstats count as sno by host | where sno>4 | fields - sno

The streamstats (after sort) will generate rank for AvgValue for each host and where clause will filter to leave only the top 3 AvgValue per host.

View solution in original post

somesoni2
SplunkTrust
SplunkTrust

Give this a try

earliest=-15m environment=prod source="Perfmon:Process"  counter="% Processor Time"  (instance!="_Total" AND instance!="Idle" AND instance!="System") | stats avg(Value) as AvgValue by host,instance | sort 0 -host,-AvgValue 
| streamstats count as sno by host | where sno>4 | fields - sno

The streamstats (after sort) will generate rank for AvgValue for each host and where clause will filter to leave only the top 3 AvgValue per host.

manmah4u
Explorer

Thanks It works.

0 Karma

HiroshiSatoh
Champion

Try this!

(your search)|sort host - avg(Value) |dedup 3 host

0 Karma

tom_frotscher
Builder

Hi!

You can try to sort the search results by your processor time field and then show only the first 3 results with the head command. Should be something like this:

... | sort - "%Processor Time" | head 3

If your goal is to first calculate the average, like in your posted search query, then:

earliest=-15m environment=prod source="Perfmon:Process" counter="% Processor Time" | where (instance!="_Total" AND instance!="Idle" AND instance!="System") | stats avg(Value) as cputime by host,instance | sort - cputime | head 3
0 Karma
Get Updates on the Splunk Community!

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...

Let’s Get You Certified – Vegas-Style at .conf24

Are you ready to level up your Splunk game? Then, let’s get you certified live at .conf24 – our annual user ...