Hi all,
Can you please help me with the Splunk query to list the Windows Process Names and CPU utilizations for the particular hostname. I have made the query as follows:-
index=tuuk_perfmon source="Perfmon:Process" counter="% Processor Time" host=*hostname* (instance!="_Total" AND instance!="Idle" AND instance!="System") | eval 'CPU'=round(process_cpu_used_percent,2) | timechart latest('CPU') by process_name
With the above mentioned query, i can able to get the CPU utilization results for listed Windows Process names, but when analyzing the results, for particular time frame there are multiple 100% CPU utilization for mutiple Windows process names.
Could someone please suggest or validate whether i am getting valid results and also the reason for multiple 100% CPU utilization?
Take a look at this article on Process\% Processor Time
How many cores does your machine have?
Thanks for the reply!! Mostly 4 to 8 Cores for Windows Servers..
Process names, but when analyzing the results, for particular time frame there are multiple 100% CPU utilization for mutiple Windows process names.
Are these 100% utilization for multiple process names on a single host or multiple hosts? Your last stats is | timechart latest('CPU') by process_name, which aggregates across all that match host=*hostname*. Is there any reason why there must not be multiple 100%?
Maybe you are looking for groupby process_name AND host?
index=tuuk_perfmon source="Perfmon:Process" counter="% Processor Time" host=*hostname* (instance!="_Total" AND instance!="Idle" AND instance!="System") | eval 'CPU'=round(process_cpu_used_percent,2)
| timechart latest('CPU') by process_name host
The output will not be pretty but it's an idea.
Thanks for the reply!!
The stats i am looking for single windows servers.
| timechart latest('CPU') by process_name host
timechart followed by process_name host does not work