I have this Splunk stanza below:
[perfmon://CPUTime]
interval = 30
object = Processor
counters = % Processor Time
instances = _Total
disabled = 0
index = perfmon
When I run this search, I get a result of around 50+%
index = perfmon ( datacenter="iad" ) ( environment="prod" ) ( host="ms10191" ) ( counter="% Processor Time" ) ( instance="_Total" ) | eval name=host+"-"+counter+"-"+instance | timechart avg(Value) by name
But when I check through the Performance Counter on the server, I am getting a value around 15-20%
Is splunk showing wrong data?
Are the time spans that you are averaging over in your Splunk search the same than the sampling periods configured in Perfmon for your Windows hosts? If those don't match, one would expect the results to be different, no? Note that you are pulling Perfmon data every 30 seconds.
I know this is old, but I was hoping you may have found an answer. I'm also observing different returned values in splunk than what is in perfmon local to the server.