I am trying to get a representation of the percentage of CPU used per windows process based on the amount of processors per client server. To accomplish this I am looking to divide one field value (processcpuused_percent) by another field value (NumberOfLogicalProcessors) to get the final percentage of cpu used by process (based on the number of processors). I have written the following search to create the new field (cpubyprocess), however I do not see it listed in the Fields after I run the search. Should I be using a stats command instead?
Most fields are using the standard perfmon metrics from the Splunk Add-on for Microsoft Windows (https://splunkbase.splunk.com/app/742/) I've created a Powershell script that populates Splunk with the number of Logical Processors per client server to get this baseline, with a field name of NumberOfLogicalProcessors. Below is the search I have created, however the eval does not seem to be working properly by dividing the process CPU used by the number of processors per client server.
index="perfmon" (sourcetype=Perfmon:Process OR sourcetype=Perfmon:CPU counter="% Processor Time") OR sourcetype=Script:ProcessorCount host=LTJ09OKDU | eval cpu_by_process = process_cpu_used_percent / NumberOfLogicalProcessors
Just three quick things to check:
all fieldsin the
NumberOfLogicalProcessorsa string or a numeric value?
Thanks for the response MuS. Yes, I did verify the select all fields. The NumberOfLogicalProcessors is a numeric field, that is where I am running into the issue. This value will be dynamic based on the client server Processor Number count. (this works if I divide by a static number in the eval eg: | eval cpubyprocess = processcpuused_percent / 4 And when I run the search (without the eval) I am able to see both fields without issue, NumberOfLogicalProcessors AND processcpuused_percent. I'm just not sure how to approach this one.
I just had a poke in some perfmon events and was not able to find the field
process_cpu_used_percent, where do you get this one from?
I was able to get the results need doing a subsearch.
index="perfmon" (sourcetype=Perfmon:Process OR sourcetype=Perfmon:CPU counter="% Processor Time")
| eval cpubyprocess=processcpuused_percent / [search sourcetype="Script:ProcessorCount" host="*"
| return $NumberOfLogicalProcessors]