I am using the Universal Forwarder to collect information on a Java Process. When monitoring "% Processor Time" for a specific process, I noticed a discrepancy between the results from Performance Monitor vs. Resource Monitor for this process when pulling the information using default values (below is my input.conf value): [perfmon://Process] object = Process counters = % Processor Time;Working Set;Working Set Peak; instances = _Total;java;javaw interval = 10 It seems to be corrected when I scale % Processor Time down to 10% of the default value when building my splunk search (shown below): host="" (counter="% Processor Time" AND instance=java OR instance=javaw) OR (collection="CPU Load" AND instance=_Total) | timechart span=20s avg(Value) AS "CPU Utilization" by instance | eval java=java/10 | eval javaw=javaw/10 | rename java as "Appserver CPU" javaw as "Client CPU" VALUE_Total as "Total Machine CPU" I thought this fixed the issue until we actually get a spike in CPU and I noticed the java and javaw values now max out at 10% and wont go any higher. I know it is supposed to max out at 100% and I scaled it down to 10% of the normal value, that makes sense to me but if it really is maxing out there, why can't I get the real values sent to the indexer from perfmon in the first place. Any help would be much appreciated. Thanks! ... View more