Hello, We need to find the highest CPU consumed Process in the windows machine, not the total highest cpu. Please help how to implement the same. Is the PercentProcessorTime is the field to be con...
See more...
Hello, We need to find the highest CPU consumed Process in the windows machine, not the total highest cpu. Please help how to implement the same. Is the PercentProcessorTime is the field to be considered for the splunk query or how we can calculate the same [WMI:ProcessesCPU] interval = 60 wql = SELECT Name, PercentProcessorTime, PercentPrivilegedTime, PercentUserTime, ThreadCount FROM Win32_PerfFormattedData_PerfProc_Process WHERE PercentProcessorTime>0 disabled = 0 Below query is not giving exact output, its giving sum of all processes above 100. We need to find out the process which uses highest cpu index="index1" host=windows2 source="WMI:ProcessesCPU" | WHERE NOT Name="_Total" | WHERE NOT Name="System" | WHERE NOT Name="Idle" | streamstats dc(_time) as distinct_times | head (distinct_times == 1) | stats latest(PercentProcessorTime) as CPU% by Name | sort -ProcessorTime |eval AlertStatus=if('CPU%'> 90, "Alert", "Ignore") |search AlertStatus="Alert"