Splunk Search

avg cpu usage

mlevenson
Explorer

Trying to create a report for avg CPU usage and failing.

current search is

splunk_server=red counter="% Processor Time" | eval IdleCpu=(100-Value)|table host avg(IdleCpu)

I just want to get the average cpu usage over a given period of time. I get the data but things are not being averaged out.

Tags (3)
0 Karma

sdaniels
Splunk Employee
Splunk Employee

Once you have the calculated the value you want for CPU, in this case idle CPU you just pipe it to time chart and use avg() by host. Is this what you are looking for?

... | timechart span=1m avg(idleCPU) by host

sdaniels
Splunk Employee
Splunk Employee

Just use the tail command. You could also sort it in ascending order to see those with greatest idle time at the top.

... | tail 10

http://docs.splunk.com/Documentation/Splunk/latest/SearchReference/tail

0 Karma

mlevenson
Explorer

This is what I came up with so far.

splunk_server=red counter="% Processor Time" | eval IdleCpu=(100-Value) | eval IdleCpu=round(IdleCpu,2)|chart avg(IdleCpu) as IdleCpu by host

Yours gives me no results found. Now if I could just get the bottom 10 to 15 hosts that have the smallest idle times. | top host gives me the systems with the greatest idle time and I want the system with the least idle time.

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...