CPU ready time was just about the hardest thing for me to get my head around when I started working with vSphere and I'm still not always sure that I get it completely. The hardest part in understanding ready time is remembering that it is a summation of the ready times for all the vCPUs the VM has. However, when VMware talks about when you should worry they talk about ready times on a per vCPU basis. This means that you have to factor in how many vCPUs a machine has.
VMware says that 1000ms/vCPU should be the warning point and 2000ms/vCPU should be the critical point. Since CPU ready times are collected over a 20 second period (20000ms) these work out to 5% and 10% respectively. The search below is what I use to look at CPU ready times. For any given VM it will look up the VM in the inventory that Splunk generates so that it can divide the SumRdy_ms by the number of CPUs (numCpu). From that I can then get the max values and the average values for my normalized Sum Ready Time.
index=vmware source="VirtualMachinePerf" SumRdy_ms="*" perftype="cpu" moname="vmname"
| lookup TimeHierarchyVMSummary moname
| eval SumRdyPerCpu_ms=(SumRdy_ms / numCpu)
| timechart max(SumRdy_ms) AS "Sum Ready Time"
max(SumRdyPerCpu_ms) AS "Max Normalized Ready Time"
avg(SumRdyPerCpu_ms) AS "Average Normalized Ready Time"
... View more