topic Re: The alarm time statistics in Splunk Search

The alarm time statistics

laiyongmao — Wed, 04 Dec 2013 10:01:58 GMT

Now that there is such a demand, I set up an alarm, when I CPU use rate of more than 90% began to alarm, when the CPU utilization rate of less than 90% is to lift the alarm, the alarm time can be counted a total of ?I don't know Splunk can achieve now, who can help me?

Re: The alarm time statistics

jtrucks — Wed, 04 Dec 2013 16:09:01 GMT

Please provide examples of the log events for each of these states: alarm triggered, alarm canceled.

With the format of the logs, we can help you create a transaction based query to answer this question.

Re: The alarm time statistics

laiyongmao — Thu, 05 Dec 2013 05:41:17 GMT

thanks jtrucks!
I want to know about an event to another event, such as the int/0 down to int/0 up the time.

13-12-5 上午11时32分59.000秒 int/0 down
13-12-5 上午11时32分57.000秒 int/1 up
13-12-5 上午11时32分56.000秒 int/1 down
13-12-5 上午11时19分29.000秒 int/0 up
13-12-5 上午11时19分29.000秒 int/2 down
13-12-5 上午11时16分47.000秒 int/0 down

thank you very much! What are you chatting tool? How can I contact you?

Re: The alarm time statistics

laiyongmao — Fri, 06 Dec 2013 08:16:54 GMT

The problem has been solved.