Splunk Search

Query to display average cpu usage for all splunk search heads & indexers

Explorer

I'm building reporting for capacity planning to improve the performance across our splunk environment. During my company's peak period of year, our indexers CPU gets pegged and I'd like to query for that date range to display this activity. I've been trying out a few different queries but I have no been able to get quite what I'm looking for.

index=main host=splunk* source="Perfmon:CPU" counter="% Processor Time" | stats avg(Value) as "CPU Processor Time" by host

Can anyone also help me gather the avg > 75% cpu processor time?

0 Karma
1 Solution

Revered Legend

How about this

index=main host=splunk* source="Perfmon:CPU" counter="% Processor Time" | bucket span=1d _time | stats avg(Value) as avgcpu by _time host | where avgcpu>75.0| timechart span=1d  avg(avgcpu) as "CPU Processor Time" by host limit=0 

View solution in original post

Explorer

Thank @somesoni2

0 Karma

Revered Legend

How about this

index=main host=splunk* source="Perfmon:CPU" counter="% Processor Time" | bucket span=1d _time | stats avg(Value) as avgcpu by _time host | where avgcpu>75.0| timechart span=1d  avg(avgcpu) as "CPU Processor Time" by host limit=0 

View solution in original post

State of Splunk Careers

Access the Splunk Careers Report to see real data that shows how Splunk mastery increases your value and job satisfaction.

Find out what your skills are worth!