Splunk Search

Query to display average cpu usage for all splunk search heads & indexers

jward6004
Explorer

I'm building reporting for capacity planning to improve the performance across our splunk environment. During my company's peak period of year, our indexers CPU gets pegged and I'd like to query for that date range to display this activity. I've been trying out a few different queries but I have no been able to get quite what I'm looking for.

index=main host=splunk* source="Perfmon:CPU" counter="% Processor Time" | stats avg(Value) as "CPU Processor Time" by host

Can anyone also help me gather the avg > 75% cpu processor time?

0 Karma
1 Solution

somesoni2
SplunkTrust
SplunkTrust

How about this

index=main host=splunk* source="Perfmon:CPU" counter="% Processor Time" | bucket span=1d _time | stats avg(Value) as avgcpu by _time host | where avgcpu>75.0| timechart span=1d  avg(avgcpu) as "CPU Processor Time" by host limit=0 

View solution in original post

jward6004
Explorer

Thank @somesoni2

0 Karma

somesoni2
SplunkTrust
SplunkTrust

How about this

index=main host=splunk* source="Perfmon:CPU" counter="% Processor Time" | bucket span=1d _time | stats avg(Value) as avgcpu by _time host | where avgcpu>75.0| timechart span=1d  avg(avgcpu) as "CPU Processor Time" by host limit=0 
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...