We're running into the same problem here. Splunk Add-on for *nix 5.2.3 and Splunk Universal Forwarder 6.5.2. I have 12 forwarder clients all running Ubuntu 14.04 and a third of them an incorrect value in the CPU field.
I checked the output of cpu.sh on two systems and they both output the CPU core number in the first column. However once this output is ingested into Splunk, only one of them has a valid number (or "all") in the CPU field. The other one has something like "48.0" in the CPU field, which appears to be a load average.
This makes us unable to compare CPU usage across hosts.
... View more