Splunk Search

Query to display average cpu usage for all splunk search heads & indexers

jward6004
Explorer

I'm building reporting for capacity planning to improve the performance across our splunk environment. During my company's peak period of year, our indexers CPU gets pegged and I'd like to query for that date range to display this activity. I've been trying out a few different queries but I have no been able to get quite what I'm looking for.

index=main host=splunk* source="Perfmon:CPU" counter="% Processor Time" | stats avg(Value) as "CPU Processor Time" by host

Can anyone also help me gather the avg > 75% cpu processor time?

0 Karma
1 Solution

somesoni2
Revered Legend

How about this

index=main host=splunk* source="Perfmon:CPU" counter="% Processor Time" | bucket span=1d _time | stats avg(Value) as avgcpu by _time host | where avgcpu>75.0| timechart span=1d  avg(avgcpu) as "CPU Processor Time" by host limit=0 

View solution in original post

jward6004
Explorer

Thank @somesoni2

0 Karma

somesoni2
Revered Legend

How about this

index=main host=splunk* source="Perfmon:CPU" counter="% Processor Time" | bucket span=1d _time | stats avg(Value) as avgcpu by _time host | where avgcpu>75.0| timechart span=1d  avg(avgcpu) as "CPU Processor Time" by host limit=0 
Get Updates on the Splunk Community!

Splunk Observability Cloud’s AI Assistant in Action Series: Analyzing and ...

This is the second post in our Splunk Observability Cloud’s AI Assistant in Action series, in which we look at ...

Elevate Your Organization with Splunk’s Next Platform Evolution

 Thursday, July 10, 2025  |  11AM PDT / 2PM EDT Whether you're managing complex deployments or looking to ...

Splunk Answers Content Calendar, June Edition

Get ready for this week’s post dedicated to Splunk Dashboards! We're celebrating the power of community by ...