To Add i am using the query: index=os sourcetype=foo OR sourcetype=coo host=$hostname$ | multikv fields pctCPU COMMAND PercentProcessorTime Name | multisearch [ search host=$hostname$ COMMAND="splunk*"] [search host=$hostname$ Name="splunk*" | eval pctCPU="PercentProcessorTime"] | timechart span=15m max(pctCPU) by host | sort _time As posted earlier, gives me results for Linux hosts but not for Windows hosts. Please help ... View more

Hi Manish, That did not work... maybe i should have explained better.. I have multiple Linux hosts and Multiple Windows hosts.. Linux hosts come with index=os and fields pctCPU and COMMAND However, windows hosts come with fields PercentProcessorTime and Name(which has splunkd info) i have tokens created for all these hosts as you already know by "$hostname$ I now need a query which will show how much CPU Splunk is utilizing on these servers and display a graph on my dashboard. Please help. Quick help much appreciated... ... View more

Thanks again Manish! All i want from the query is for it to display on my dashboard the usage of Splunk resource utilization of the CPU(splunkd) on each server(Windows/Linux) in just one query... ... View more

Thanks Manish.. Will definitely try and get back... Also just to clarify, will the multisearch usage not work? ... View more

Came up with this query: index=os sourcetype=foo OR sourcetype=coo host=$hostname$ | multikv fields pctCPU COMMAND PercentProcessorTime Name | multisearch [ search host=$hostname$ COMMAND="splunk*"] [search host=$hostname$ Name="splunk*" | eval pctCPU="PercentProcessorTime"] | timechart span=15m max(pctCPU) by host | sort _time Could someone please help in letting me know if this is the right query to get results as i need it to be? ... View more

To add on i will need the graph to either show max values for Linux or for windows at a time in a consolidated query ... View more

Thank you Rich Galloway! Sorry for the late response... I got the processes for the Windows servers indexed. Could you please help me merge a query for Linux with Windows ? The query i use is as below: index=os sourcetype=foo OR sourcetype=coo host=$hostname$ | multikv fields pctCPU COMMAND | search host=$hostname$ COMMAND="splunk*" | timechart span=15m max(pctCPU) by host | sort _time The indexed fields for windows is: PercentTime for pctCPU and Name for Command. ... View more

Hello there! Tried below and variations of below: earliest=-15m sourcetype="Perfmon:CPU" counter="% Processor Time" | where (instance!="Idle" AND instance!="System") | stats avg(Value) by host,instance even though does not exactly meet my requirement. Nothing works because, i am getting logs only of "instance=_Total" Please let me know if you need more details. Thanks a ton! Greatly appreciate a quick response. ... View more