Splunk Search

Splunk CPU Usage Query

sheepIT
Engager

Hello all,

 

I am relatively new to Splunk, having just inherited a whole Splunk environment due to our former Splunk Admin leaving. I'm having issues with setting up a dashboard that returns the top 10 windows hosts with the most CPU usage, essentially I need a query that would calculate and return that.  I can find the windows hosts under the _internal and perfmon indexes. 

I managed to find and customize this query:

index=perfmon object=Process counter="%_Processor_Time" host=WINSERVER1 earliest=-2m latest=now NOT instance IN(_Total,Idle,System)
| stats perc90(Value) as Value by host
| top limit=10 Value by host

 

However, it returns all the hosts in the index, and not the top 10 hosts with the highest CPU usage. Also comparing the CPU usage, it seems like it is incorrect, as when I open task manager and compare, they are noticeably different, so it makes me wonder if my calculation is off? Or what calculation would be most accurate in determining the CPU usage of individual hosts? 

Labels (1)
1 Solution

sheepIT
Engager

Hi @gcusello 

I used most of what you did, along with some functions I found and now have it like this.

index=perfmon object=Process counter="%_Processor_Time" host=WINSERVER1 earliest=-2m latest=now NOT instance IN(_Total,Idle,System)
| stats perc90(Value) as Value by host

| eval Value=round(Value,2)
| sort -Value | head 10

View solution in original post

gcusello
SplunkTrust
SplunkTrust

Hi @sheepIT,

you have two solutions:

  • the top command,
  • the stats and sort commands:

top command

index=perfmon object=Process counter="%_Processor_Time" host=WINSERVER1 earliest=-2m latest=now NOT instance IN(_Total,Idle,System)
| top perc90(Value) as Value by host limit=10

stats and sort commands

index=perfmon object=Process counter="%_Processor_Time" host=WINSERVER1 earliest=-2m latest=now NOT instance IN(_Total,Idle,System)
| stats perc90(Value) as Value by host
| sort 10 BY Value

the first is easier but I usually use the second solution.

Ciao.

Giuseppe

sheepIT
Engager

Hi @gcusello 

I used most of what you did, along with some functions I found and now have it like this.

index=perfmon object=Process counter="%_Processor_Time" host=WINSERVER1 earliest=-2m latest=now NOT instance IN(_Total,Idle,System)
| stats perc90(Value) as Value by host

| eval Value=round(Value,2)
| sort -Value | head 10

gcusello
SplunkTrust
SplunkTrust

Hi @sheepIT,

good for you, see next time!

Ciao and happy splunking

Giuseppe

P.S.: Karma Points are appreciated 😉

gcusello
SplunkTrust
SplunkTrust

Hi @sheepIT,

is it ok for you?

Ciao.

Giuseppe

Get Updates on the Splunk Community!

Splunk Observability Cloud’s AI Assistant in Action Series: Analyzing and ...

This is the second post in our Splunk Observability Cloud’s AI Assistant in Action series, in which we look at ...

Elevate Your Organization with Splunk’s Next Platform Evolution

 Thursday, July 10, 2025  |  11AM PDT / 2PM EDT Whether you're managing complex deployments or looking to ...

Splunk Answers Content Calendar, June Edition

Get ready for this week’s post dedicated to Splunk Dashboards! We're celebrating the power of community by ...