Splunk CPU Usage Query

[sheepIT]

Hello all,

I am relatively new to Splunk, having just inherited a whole Splunk environment due to our former Splunk Admin leaving. I'm having issues with setting up a dashboard that returns the top 10 windows hosts with the most CPU usage, essentially I need a query that would calculate and return that.  I can find the windows hosts under the _internal and perfmon indexes. 

I managed to find and customize this query:

index=perfmon object=Process counter="%_Processor_Time" host=WINSERVER1 earliest=-2m latest=now NOT instance IN(_Total,Idle,System)
| stats perc90(Value) as Value by host
| top limit=10 Value by host

However, it returns all the hosts in the index, and not the top 10 hosts with the highest CPU usage. Also comparing the CPU usage, it seems like it is incorrect, as when I open task manager and compare, they are noticeably different, so it makes me wonder if my calculation is off? Or what calculation would be most accurate in determining the CPU usage of individual hosts? 

[gcusello]

Hi @sheepIT,

you have two solutions:

• the top command,
• the stats and sort commands:

top command

index=perfmon object=Process counter="%_Processor_Time" host=WINSERVER1 earliest=-2m latest=now NOT instance IN(_Total,Idle,System)
| top perc90(Value) as Value by host limit=10

stats and sort commands

index=perfmon object=Process counter="%_Processor_Time" host=WINSERVER1 earliest=-2m latest=now NOT instance IN(_Total,Idle,System)
| stats perc90(Value) as Value by host
| sort 10 BY Value

the first is easier but I usually use the second solution.

Ciao.

Giuseppe

[sheepIT · Accepted solution]

Hi @gcusello 

I used most of what you did, along with some functions I found and now have it like this.

index=perfmon object=Process counter="%_Processor_Time" host=WINSERVER1 earliest=-2m latest=now NOT instance IN(_Total,Idle,System)
| stats perc90(Value) as Value by host

| eval Value=round(Value,2)
| sort -Value | head 10

[gcusello]

Hi @sheepIT,

good for you, see next time!

Ciao and happy splunking

Giuseppe

P.S.: Karma Points are appreciated 😉

[gcusello]

Hi @sheepIT,

is it ok for you?

Ciao.

Giuseppe