Query to display average cpu usage for all splunk search heads & indexers

[jward6004]

I'm building reporting for capacity planning to improve the performance across our splunk environment. During my company's peak period of year, our indexers CPU gets pegged and I'd like to query for that date range to display this activity. I've been trying out a few different queries but I have no been able to get quite what I'm looking for.

index=main host=splunk* source="Perfmon:CPU" counter="% Processor Time" | stats avg(Value) as "CPU Processor Time" by host

Can anyone also help me gather the avg > 75% cpu processor time?

[jward6004]

Thank @somesoni2

[somesoni2 · Accepted solution]

How about this

index=main host=splunk* source="Perfmon:CPU" counter="% Processor Time" | bucket span=1d _time | stats avg(Value) as avgcpu by _time host | where avgcpu>75.0| timechart span=1d  avg(avgcpu) as "CPU Processor Time" by host limit=0