Hi davidpaper,
You've hit the nail on the head. However unfortunately I don't actually care about busy, I have enough monitoring elsewhere to figure out busy and cause thereof, just concurrency at this point. sigh
It's an interesting conundrum because one of the sizing factors Splunk recommend is 1 user per core (ideally 2) hence concurrency would seem to be a useful measure in sizing...
thanks for pointers so far everyone
PS - As MuS rightly surmised. I am using LDAP, forgot to mention that bit!
... View more