Splunk Search

avg cpu usage

mlevenson
Explorer

Trying to create a report for avg CPU usage and failing.

current search is

splunk_server=red counter="% Processor Time" | eval IdleCpu=(100-Value)|table host avg(IdleCpu)

I just want to get the average cpu usage over a given period of time. I get the data but things are not being averaged out.

Tags (3)
0 Karma

sdaniels
Splunk Employee
Splunk Employee

Once you have the calculated the value you want for CPU, in this case idle CPU you just pipe it to time chart and use avg() by host. Is this what you are looking for?

... | timechart span=1m avg(idleCPU) by host

sdaniels
Splunk Employee
Splunk Employee

Just use the tail command. You could also sort it in ascending order to see those with greatest idle time at the top.

... | tail 10

http://docs.splunk.com/Documentation/Splunk/latest/SearchReference/tail

0 Karma

mlevenson
Explorer

This is what I came up with so far.

splunk_server=red counter="% Processor Time" | eval IdleCpu=(100-Value) | eval IdleCpu=round(IdleCpu,2)|chart avg(IdleCpu) as IdleCpu by host

Yours gives me no results found. Now if I could just get the bottom 10 to 15 hosts that have the smallest idle times. | top host gives me the systems with the greatest idle time and I want the system with the least idle time.

0 Karma
.conf21 Now Fully Virtual!
Register for FREE Today!

We've made .conf21 totally virtual and totally FREE! Our completely online experience will run from 10/19 through 10/20 with some additional events, too!