Splunk Search

PercentProcessorTime inaccurate

chowell
Explorer

On a Windows 2008 R2 server, I've been comparing the %Processor Time counter on the _Total instance from Perfmon with the PercentProcessorTime counter on the _Total instance of the PerfOS_Processor object in Splunk. The output from the counters is never the same. In Splunk, I created a separate index and started sampling at one second intervals to see if I could get the two counters to line up but they don't. I'm running version 4.2.1 build 98164. Can someone help me discovery why there is a discrepancy?

Thanks,

--Carl

Tags (1)
0 Karma

hazekamp
Builder

Carl,

I would suspect that unless the counters happened to kick off at the exact same time there could be a discrepancy in %Processor Time. If you were to look at the averages using timechart over a reasonable period of time, do the graphs align?

0 Karma

hazekamp
Builder

Thanks for that clarification. Based on your description I too find this odd. I would also recommend filing an issue on this for support to look into.

0 Karma

chowell
Explorer

Sorry, I was being a little to granular with the problem description. The values returned are not even close. For example, Splunk might report a value of 58 PercentProcessorTime and I'll look to see if Perfmon reports that value within say 10 seconds of when Splunk reports it and it never happens.

This same behavior is occurring on all the machines we are monitoring this way. They are all physical machines. I can't tell you that Splunk ever reported the correct values. I just know that at review meetings engineers are getting freaked out when they see the numbers Splunk is reporting.

0 Karma
Get Updates on the Splunk Community!

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...

Let’s Get You Certified – Vegas-Style at .conf24

Are you ready to level up your Splunk game? Then, let’s get you certified live at .conf24 – our annual user ...