I'm using streamstats to get some values from the last event, but I need to do it where that last event has a property matching a value. So I'm trying to solve the problem of inaccurate PercentProcessorTime with the Windows perf data. I started with the discussion here, but it's morphed beyond that now. So to start, I've got a WMI query which leverages Win32_PerfRawData_PerfProc_Process. wql = Select IDProcess,Name,PercentProcessorTime,TimeStamp_PerfTime,Frequency_PerfTime,PercentUserTime,TimeStamp_Sys100NS from Win32_PerfRawData_PerfProc_Process where Name = "SQLsafeBackupService" OR Name = "sqlwriter" OR Name = "sqlservr" OR Name = "SQLAGENT" OR Name = "sqlservr#1" OR Name = "SQLAGENT#1" OR Name = "w3wp" OR Name = "sqlbrowser" Then using my Google-foo, I found this math to cook the value: eval cputime = 100 * (PercentProcessorTime - last_PercentProcessorTime) / (Timestamp_Sys100NS - last_Timestamp_Sys100NS) So far so good, this search actually does exactly what I want: earliest=-10m index=rel_test Name=sqlservr | reverse | streamstats current=f last(PercentProcessorTime) as last_PercentProcessorTime last(Timestamp_Sys100NS) as last_Timestamp_Sys100NS | eval cputime = 100 * (PercentProcessorTime - last_PercentProcessorTime) / (Timestamp_Sys100NS - last_Timestamp_Sys100NS) | timechart span=3 avg(cputime) Except that I'm stuck with just one "Name". In the data, Name is a unique identifier which identifies a process. So I need to compare sqlservr to the last sqlservr, but if I include all processes (which is what I want), then I have no way to compare to the last sqlservr and not the last w3wp. Does this make sense? Does anyone have a solution? I tried sorting on Name, but the deltas in the counters when the Name changes throws the results out of whack. After running timechart, if I could throw away the first row, that would work too ... View more

Splunk 6.1 running on Windows 2012 R1 perfmon remote machine Windows 2008 R1. Querying PercentProcessorTime from PerfProc_Process, processes max out at 100%, but this is not correct. Multi-threaded processes can span multiple CPUs, and the theoretical maximum value for this counter is 100 * total CPU cores. Watching % Processor Time in pefmon, I see an instance of sqlserver cross 400%, which is expected, since this represents 25% of my 16 core server. 1) Am I using the wrong counter/query? 2) Is this a known issue with this version of Splunk? 3) Is it a bug? From powershell (zero valued entries removed) PS C:\Users\admin.rlabrie> Get-Counter "\Process(*)\% Processor Time" Timestamp CounterSamples --------- -------------- 10/13/2015 8:06:21 AM \\loris-sqlb\process(idle)\% processor time : 1184.87433030096 \\loris-sqlb\process(sqlservr)\% processor time : 179.805832224659 \\loris-sqlb\process(w3wp)\% processor time : 152.143396497789 \\loris-sqlb\process(_total)\% processor time : 1578.29563841645 ... View more

Hi, Splunk 6.2 on Windows. Can/should a deployment server be clustered somehow? I can't find any docs on this. I imagine shared data on NFS and servers behind a load balancer. ... View more

So this has been asked, and I've googled it hard, but I can't seem to find a concise answer. Can I pass additional parameters to an alert script? Say for arguments sake, I have dosomethingawesome.py, and I want to re-use it for different alerts, and maybe I want to pass in a -server parameter or a -awesomelevel parameter into dosomethingawesome.py, can I do that? Of course I tried and it looks like no, I just want to know for sure: is it impossible? Thanks, Rob ... View more

This sounds so easy but I can't seem to figure it out. Or maybe it's just ridiculous and there is a better way. So I have index=iis | timechart count by cs_uri_stem And that's great, but what if I want to smooth out the timechart with an average? Or maybe just plot the deltas? Doing avg(count(_raw)) doesn't cut the mustard. Basically I want to try and stomp down the occasional spikes (which yes need attention in some circumstances) and just get an idea if hitcount is trending up. Any ideas? ... View more