topic Re: CPU alert when it exceeds a threshold in Monitoring Splunk

CPU alert when it exceeds a threshold

sunilsk1 — Mon, 28 Sep 2020 14:38:41 GMT

I want the results where the CPU is more then 10% . The above Query isn't returning any result Set.

Re: CPU alert when it exceeds a threshold

sdaniels — Mon, 28 Sep 2020 14:38:44 GMT

The first thing I'd recommend is doing a pipe to table and break this thing down to make sure you're getting the numbers you think you are getting.

what is this part for - '| search all'? I'm guessing if you do the follow below you may not have any data.

index=os host= sourcetype=cpu | lookup chipotl fqdn as host | search application_name="New Apps" AND physical_environment_name="SystemTestWest" AND state="LIVE"| multikv fields pctUser,pctSystem,pctIowait,pctIdle,application_name | search all | table pctIdle, application_name

Re: CPU alert when it exceeds a threshold

rechteklebe — Mon, 28 Sep 2020 14:38:52 GMT

try at the end with:

stats avg(Percent_CPU_Load) as cpu_load by host,application_name | where cpu_load > 10

Re: CPU alert when it exceeds a threshold

sunilsk1 — Mon, 28 Sep 2020 14:38:55 GMT

thanks all for yours answer.
This thing worked for me by piping the data out -->
|rename avg(cpu) as cpualert|where cpualert >35

Here's the complete query that worked for me -

Re: CPU alert when it exceeds a threshold

sunilsk1 — Mon, 26 Aug 2013 06:56:03 GMT

the next issue , I have scheduled the alert and the complete result along with Search query is sent to all my Users.
Is there way that I can send only the Search results and hide the Query and all other log details.

Re: CPU alert when it exceeds a threshold

sunilsk1 — Mon, 26 Aug 2013 06:56:15 GMT