Skip to main content
Splunk Lantern

Azure overprovisioned virtual machines

 

Virtual machine (VM) instances with consistently low CPU utilization might be contributing to excessive or wasted cloud spend. Likewise, virtual machines with consistently high CPU utilization may experience performance issues associated with CPU resource constraints. Use this procedure to identify VMs that you might be able to downsize to save on cloud costs or that may be candidates for upsizing to ensure workloads run smoothly and without limitations.

Data required 

Microsoft Azure data

Procedure

  1. Configure the Microsoft Azure Add-on for Splunk.
  2. Run the following search. You can optimize it by specifying an index and adjusting the time range.
sourcetype=azure:metrics  metric_name="Percentage CPU" 
| eval {metric_name}=average
| stats sparkline(avg(Percentage CPU),5m) AS cpu_trend avg(Percentage CPU) AS avg_cpu perc99(Percentage CPU) AS p99_cpu BY host
| where avg_cpu < 50 and p99_cpu < 95
| sort p99_cpu

Search explanation

The table provides an explanation of what each part of this search achieves. You can adjust this query based on the specifics of your environment.

Splunk Search Explanation
sourcetype=azure:metrics metric_name="Percentage CPU" Search Azure metrics data in the Percentage CPU metric. 
| eval {metric_name}=average Create a new field for the Percentage CPU metric with the average value.
| stats sparkline(avg(Percentage CPU),5m) AS cpu_trend avg(Percentage CPU) AS avg_cpu perc99(Percentage CPU) AS p99_cpu BY host Identify average and max CPU utilization per instance.
| where avg_cpu < 50 and p99_cpu < 95

Use the sparkline function to visualize the CPU trend over time to see which are overprovisioned.

To see which machines are underprovisioned, switch this line to | where avg_cpu > 50 and p99_cpu > 95

| sort p99_cpu Sort by instances where CPU utilization is consistently low.

Next steps

You might also be interested in other processes associated with the Managing Azure cloud infrastructure use case.