I'm building reporting for capacity planning to improve the performance across our splunk environment. During my company's peak period of year, our indexers CPU gets pegged and I'd like to query for that date range to display this activity. I've been trying out a few different queries but I have no been able to get quite what I'm looking for.
index=main host=splunk* source="Perfmon:CPU" counter="% Processor Time" | stats avg(Value) as "CPU Processor Time" by host
Can anyone also help me gather the avg > 75% cpu processor time?
How about this
index=main host=splunk* source="Perfmon:CPU" counter="% Processor Time" | bucket span=1d _time | stats avg(Value) as avgcpu by _time host | where avgcpu>75.0| timechart span=1d avg(avgcpu) as "CPU Processor Time" by host limit=0
Thank @somesoni2
How about this
index=main host=splunk* source="Perfmon:CPU" counter="% Processor Time" | bucket span=1d _time | stats avg(Value) as avgcpu by _time host | where avgcpu>75.0| timechart span=1d avg(avgcpu) as "CPU Processor Time" by host limit=0