topic Re: Check Multiple Pre-defined Searches and Return one value in Getting Data In

Check Multiple Pre-defined Searches and Return one value

chamil3001 — Mon, 28 Sep 2020 13:31:24 GMT

Heres what i want to do.

Scenario,
Monitor threshold breaches of CPU,HDD and memory etc

1) I have multiple searches written for each of the above and they work ok.

Eg2: host="MYHOST1" source="Perfmon:Total_Processor_Time" counter="% Processor Time" |eval myvalues = round(Value, 2) | table myvalues |rename myvalues as "CPU Utilzation" |sort limit=1 myvalues |rangemap field="CPU Utilzation" low=0-30 elevated=31-60 default=severe

2) Now I want to check both(or multiple) of the above searches at the same time and return a value.

Eg: "Threasholds Breached!"

Thanks in Advance!
Chamil

Re: Check Multiple Pre-defined Searches and Return one value

martin_mueller — Fri, 15 Mar 2013 09:38:59 GMT

You could append them all into one big search, and alert if at least one is breached.

Re: Check Multiple Pre-defined Searches and Return one value

kristian_kolb — Fri, 15 Mar 2013 09:57:40 GMT

martin_mueller's idea exemplified;

For reasons of simplicity, this search looks at host fields, and gives you a single value if either part of the search (values h1 or h2) returns the "myhost".

index=blah  | head 1 | stats first(host) as h1 
|appendcols [search index=meh | head 1 |stats first(host) as h2 ] 
| eval host_value = if((h1=="myhost") OR (h2=="myhost"), "myhost", "not_myhost")

Re: Check Multiple Pre-defined Searches and Return one value

chamil3001 — Fri, 15 Mar 2013 13:44:26 GMT

Thank you for the quick response! Appreciate it very much..

Re: Check Multiple Pre-defined Searches and Return one value

chamil3001 — Fri, 15 Mar 2013 13:45:05 GMT

Thank you for the quick response! Appreciate it very much..

I will check it out
Just came home from office after trying to solve this all day 🙂

Re: Check Multiple Pre-defined Searches and Return one value

chamil3001 — Tue, 26 Mar 2013 03:10:24 GMT

managed to get it to work using multiple Eval commands and nested "if" functions.. thanks

Re: Check Multiple Pre-defined Searches and Return one value

chamil3001 — Tue, 26 Mar 2013 03:11:16 GMT

yeah.. got it to work, but still need to do some tuning..