topic Re: Timechart CPU by Process in Alerting

Timechart CPU by Process

mxanareckless — Fri, 19 Feb 2021 22:21:03 GMT

I'm interested in creating an alert scheduled to run every 60 minutes, that will search for hosts which have had > 85% CPU load over a span of 5 minutes. Here's the search:

From there, I would like a report generated, wherein for each host a timechart is provided for the last 60 minutes, showing CPU %s for each of the processes run on that host. Ideally this will be a line chart, with a line for each of the top 10 CPU-heavy processes. I've tried using | transaction, and this is what I have so far:

index=index sourcetype=cpu AND sourcetype=top host=$host$ | timechart latest(cpu_load_percent) by COMMAND

I'd really appreciate any guidance on how to implement an alert of this type.

Re: Timechart CPU by Process

to4kawa — Sat, 20 Feb 2021 02:03:27 GMT

I don't know the result of sourcetype=top at all, so it's hard to say.

Re: Timechart CPU by Process

mxanareckless — Mon, 22 Feb 2021 17:50:03 GMT

@to4kawa

Re: Timechart CPU by Process

to4kawa — Mon, 22 Feb 2021 23:15:48 GMT

index=index sourcetype=cpu AND sourcetype=top host=$host$ | timechart latest(cpu_load_percent) by COMMAND

sourcetype=top doesn't have cpu_load_percent.

try coalesce

Re: Timechart CPU by Process

tscroggins — Tue, 23 Feb 2021 04:44:43 GMT

@to4kawa

It should be a field alias in recent versions of Splunk_TA_nix. I just verified 8.2.0 and 8.3.0. It's not present in 5.2.4, which is the only other version I have handy.

[top]
...
FIELDALIAS-cpu_load_percent = pctCPU as cpu_load_percent