avg cpu usage

[mlevenson]

Trying to create a report for avg CPU usage and failing.

current search is

splunk_server=red counter="% Processor Time" | eval IdleCpu=(100-Value)|table host avg(IdleCpu)

I just want to get the average cpu usage over a given period of time. I get the data but things are not being averaged out.

[sdaniels]

Once you have the calculated the value you want for CPU, in this case idle CPU you just pipe it to time chart and use avg() by host. Is this what you are looking for?

... | timechart span=1m avg(idleCPU) by host

[sdaniels]

Just use the tail command. You could also sort it in ascending order to see those with greatest idle time at the top.

... | tail 10

http://docs.splunk.com/Documentation/Splunk/latest/SearchReference/tail

[mlevenson]

This is what I came up with so far.

splunk_server=red counter="% Processor Time" | eval IdleCpu=(100-Value) | eval IdleCpu=round(IdleCpu,2)|chart avg(IdleCpu) as IdleCpu by host

Yours gives me no results found. Now if I could just get the bottom 10 to 15 hosts that have the smallest idle times. | top host gives me the systems with the greatest idle time and I want the system with the least idle time.