Hi @Als123, did you already take the logs about CPU usage or do you have also to take them? If yes, you have to run a simple search like this (for Linux): index=os sourcetype=ps host=your_host
| multikv
| table USER PID PSR pctCPU CPUTIME pctMEM RSZ_KB VSZ_KB TTY S ELAPSED COMMAND ARGS If instead you have also to take logs, you have to istall on the target serve the Splunk TA-Linux Add-On (https://splunkbase.splunk.com/app/833/) enabling the inputs you want (CPU Usage). Ciao. Giuseppe
... View more