I've trying to create a multisearch that displays the Average % CPU Used by Process by Hosts for both Linux and Windows Servers. My Linux query works great but I'm having issues outputting the same for my Windows query. Please help!
[search index=perfmon host=$Hosts$ source="Perfmon:CPU" counter="% User Time" OR counter="% Processor Time"
|rename user_cpu as "% Current User CPU Load", proc_cpu as "% Current Processor Load"
| sort - "% Current User CPU Load"
One search job, one thread?
Why am I seeing CPU Usage discrepancy between S.o.S - Splunk on Splunk and PerfMon?