Splunk Search

Windows Servers - High CPU usuage of process that is greater than 90

Supriya
Path Finder

Hi Team,

I wanted to set up alert in Splunk cloud for windows machines when CPU% of a single process is greater than 90.

Please do help how to write the Query

My below query is not working properly as expected.

index="index" host="windows" source="WMI:ProcessesCPU" | WHERE NOT Name="_Total" | WHERE NOT Name="System" | WHERE NOT Name="Idle"| streamstats dc(_time) as distinct_times | head (distinct_times == 1) | stats latest(PercentProcessorTime) as CPU% by Name | sort -ProcessorTime |eval AlertStatus=if('CPU%'> 90, "Alert", "Ignore") |search AlertStatus="Alert"

wmi.conf file configuration:

[WMI:ProcessesCPU]
interval = 60
wql = SELECT Name, PercentProcessorTime, PercentPrivilegedTime, PercentUserTime, ThreadCount FROM Win32_PerfFormattedData_PerfProc_Process WHERE PercentProcessorTime>0
disabled = 0

Supriya_0-1600696831150.png

Total of all CPU processes in the windows machine should be 100% as we see in task manager.

But I'm getting 100 % for each process which is wrong.

Could some one please help

Labels (5)

bowesmana
SplunkTrust
SplunkTrust

Your query has some errors

index="index" host="host" source="WMI:ProcessesCPU" 
| WHERE NOT Name="_Total" 
| WHERE NOT Name="System" 
| WHERE NOT Name="Idle" 
| streamstats dc(_time) as distinct_times 
| head (distinct_times == 1) 
| stats latest(PercentProcessorTime) as CPU% by Name 
| sort -ProcessorTime 
| eval AlertStatus=if('CPU%'> 90, "Alert", "Ignore") 
| search AlertStatus="Alert"

what are you trying to achieve with streamstats/head combination?

Also, you have no field ProcessorTime after your stats command, so the sort does nothing.

Trying to compare, what I imagine is Perfmon data to task manager process CPU will not work as they are not reporting the same data. It looks like you need to check what your field PercentProcessorTime is actually telling you. 

 

Supriya
Path Finder

@niketn 

Could you please help us with the above Question for which we are not getting expected output.

The below is the Query we used:

index="index" host="host" source="WMI:ProcessesCPU" | WHERE NOT Name="_Total" | WHERE NOT Name="System" | WHERE NOT Name="Idle" | streamstats dc(_time) as distinct_times | head (distinct_times == 1) | stats latest(PercentProcessorTime) as CPU% by Name | sort -ProcessorTime |eval AlertStatus=if('CPU%'> 90, "Alert", "Ignore") |search AlertStatus="Alert"

The output we received is in the above screenshot.

Tags (2)
Get Updates on the Splunk Community!

How to Monitor Google Kubernetes Engine (GKE)

We’ve looked at how to integrate Kubernetes environments with Splunk Observability Cloud, but what about ...

Index This | How can you make 45 using only 4?

October 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with this ...

Splunk Education Goes to Washington | Splunk GovSummit 2024

If you’re in the Washington, D.C. area, this is your opportunity to take your career and Splunk skills to the ...