Incorrectly provisioned virtual machines
Virtual machine (VM) instances with consistently low CPU utilization might be contributing to excessive or wasted cloud spend. Likewise, virtual machines with consistently high CPU utilization may experience performance issues associated with CPU resource constraints. Use this procedure to identify VMs that you might be able to downsize to save on cloud costs or that may be candidates for upsizing to ensure workloads run smoothly and without limitations.
Data required
Microsoft: Azure data
Procedure
- Configure the Microsoft Azure Add-on for Splunk.
- Run the following search. You can optimize it by specifying an index and adjusting the time range.
sourcetype=azure:metrics metric_name="Percentage CPU"
| eval {metric_name}=average
| stats sparkline(avg(Percentage CPU),5m) AS cpu_trend avg(Percentage CPU) AS avg_cpu perc99(Percentage CPU) AS p99_cpu BY host
| where avg_cpu < 50 and p99_cpu < 95
| sort p99_cpu
Search explanation
The table provides an explanation of what each part of this search achieves. You can adjust this query based on the specifics of your environment.
| Splunk Search | Explanation |
|---|---|
| sourcetype=azure:metrics metric_name="Percentage CPU" | Search Azure metrics data in the Percentage CPU metric. |
| | eval {metric_name}=average | Create a new field for the Percentage CPU metric with the average value. |
| | stats sparkline(avg(Percentage CPU),5m) AS cpu_trend avg(Percentage CPU) AS avg_cpu perc99(Percentage CPU) AS p99_cpu BY host | Identify average and max CPU utilization per instance. |
| | where avg_cpu < 50 and p99_cpu < 95 |
Use the sparkline function to visualize the CPU trend over time to see which are overprovisioned. To see which machines are underprovisioned, switch this line to |
| | sort p99_cpu | Sort by instances where CPU utilization is consistently low. |
Next steps
You might also be interested in other processes associated with the Managing Azure cloud infrastructure use case.