Splunk Search

Windows PerfMon stats -- unable to create total_cpu field

alekksi
Communicator

Hi all,

I'm having difficulty trying to create a total_cpu field. If I map a single variable to it, this works fine and creates the field, but if I try to add them together, no field is returned.

Current query below:

sourcetype="Perfmon:Processor" host="CFDFXNFR-APP22" instance=_Total AND (counter="% User Time" OR counter="% Privileged Time" OR counter="% Interrupt Time") |

eval user=if(counter="% User Time", Value, null()) |

eval system=if(counter="% Privileged Time", Value, null()) |

eval interrupt=if(counter="% Interrupt Time", Value, null()) |

eval total_cpu=user+system+interrupt |

timechart per_second(user) as user, per_second(system) as system, per_second(idle) as idle, per_second(interrupt) as interrupt, per_second(total_cpu) as total_cpu by host limit=100 span=1s

Does anyone have any insight into what may be going wrong here?

Many thanks in advance!!

Tags (2)
0 Karma
1 Solution

somesoni2
SplunkTrust
SplunkTrust

There will be one row per counter, out of 3 rows per run of Perfmon, field user will be null for rows with count != "% User Time". Same is the case with other two fields. Try something like this

sourcetype="Perfmon:Processor" host="CFDFXNFR-APP22" instance=_Total AND (counter="% User Time" OR counter="% Privileged Time" OR counter="% Interrupt Time")| eval user=if(counter="% User Time", Value, null())   | eval system=if(counter="% Privileged Time", Value, null())   | eval interrupt=if(counter="% Interrupt Time", Value, null()| stats values(user) as user, values(system) as system values(interrupt) as interrupt by _time,host  | eval total_cpu=user+system+interrupt | timechart per_second(user) as user, per_second(system) as system, per_second(interrupt) as interrupt, per_second(total_cpu) as total_cpu by host limit=100 span=1s

View solution in original post

somesoni2
SplunkTrust
SplunkTrust

There will be one row per counter, out of 3 rows per run of Perfmon, field user will be null for rows with count != "% User Time". Same is the case with other two fields. Try something like this

sourcetype="Perfmon:Processor" host="CFDFXNFR-APP22" instance=_Total AND (counter="% User Time" OR counter="% Privileged Time" OR counter="% Interrupt Time")| eval user=if(counter="% User Time", Value, null())   | eval system=if(counter="% Privileged Time", Value, null())   | eval interrupt=if(counter="% Interrupt Time", Value, null()| stats values(user) as user, values(system) as system values(interrupt) as interrupt by _time,host  | eval total_cpu=user+system+interrupt | timechart per_second(user) as user, per_second(system) as system, per_second(interrupt) as interrupt, per_second(total_cpu) as total_cpu by host limit=100 span=1s

alekksi
Communicator

Awesome, that's fixed it!!! Many many thanks!

Had to put an if(isnull(interrupt),0,interrupt) in to get it working properly, but this was spot-on.

0 Karma
Get Updates on the Splunk Community!

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...