I am trying to get a representation of the percentage of CPU used per windows process based on the amount of processors per client server. To accomplish this I am looking to divide one field value (process_cpu_used_percent) by another field value (NumberOfLogicalProcessors) to get the final percentage of cpu used by process (based on the number of processors). I have written the following search to create the new field (cpu_by_process), however I do not see it listed in the Fields after I run the search. Should I be using a stats command instead?
Note:
Most fields are using the standard perfmon metrics from the Splunk Add-on for Microsoft Windows (https://splunkbase.splunk.com/app/742/) I've created a Powershell script that populates Splunk with the number of Logical Processors per client server to get this baseline, with a field name of NumberOfLogicalProcessors. Below is the search I have created, however the eval does not seem to be working properly by dividing the process CPU used by the number of processors per client server.
index="perfmon" (sourcetype=Perfmon:Process OR sourcetype=Perfmon:CPU counter="% Processor Time") OR sourcetype=Script:ProcessorCount host=LTJ09OKDU
| eval cpu_by_process = process_cpu_used_percent / NumberOfLogicalProcessors
I was able to get the results need doing a subsearch.
index="perfmon" (sourcetype=Perfmon:Process OR sourcetype=Perfmon:CPU counter="% Processor Time")
| eval cpu_by_process=process_cpu_used_percent / [search sourcetype="Script:ProcessorCount" host="*"
| return $NumberOfLogicalProcessors]
I was able to get the results need doing a subsearch.
index="perfmon" (sourcetype=Perfmon:Process OR sourcetype=Perfmon:CPU counter="% Processor Time")
| eval cpu_by_process=process_cpu_used_percent / [search sourcetype="Script:ProcessorCount" host="*"
| return $NumberOfLogicalProcessors]
Hi mightaswelby,
Just three quick things to check:
all fields
in the select fields
viewNumberOfLogicalProcessors
a string or a numeric value?NumberOfLogicalProcessors
AND process_cpu_used_percent
availablecheers, MuS
Thanks for the response MuS. Yes, I did verify the select all fields. The NumberOfLogicalProcessors is a numeric field, that is where I am running into the issue. This value will be dynamic based on the client server Processor Number count. (this works if I divide by a static number in the eval eg: | eval cpu_by_process = process_cpu_used_percent / 4 And when I run the search (without the eval) I am able to see both fields without issue, NumberOfLogicalProcessors AND process_cpu_used_percent. I'm just not sure how to approach this one.
I just had a poke in some perfmon events and was not able to find the field process_cpu_used_percent
, where do you get this one from?