Hello all, I am relatively new to Splunk, having just inherited a whole Splunk environment due to our former Splunk Admin leaving. I'm having issues with setting up a dashboard that returns the top 10 windows hosts with the most CPU usage, essentially I need a query that would calculate and return that. I can find the windows hosts under the _internal and perfmon indexes. I managed to find and customize this query: index=perfmon object=Process counter="%_Processor_Time" host=WINSERVER1 earliest=-2m latest=now NOT instance IN(_Total,Idle,System) | stats perc90(Value) as Value by host | top limit=10 Value by host However, it returns all the hosts in the index, and not the top 10 hosts with the highest CPU usage. Also comparing the CPU usage, it seems like it is incorrect, as when I open task manager and compare, they are noticeably different, so it makes me wonder if my calculation is off? Or what calculation would be most accurate in determining the CPU usage of individual hosts?
... View more
