topic averaging the CPU values from the recent six events in Splunk Search https://community.splunk.com/t5/Splunk-Search/averaging-the-CPU-values-from-the-recent-six-events/m-p/652302#M225455 <P>Hi,</P><P>I'm attempting to calculate the average of the last six CPU event values. If the average of those six events is greater than 95%, an alert must be sent. I basically tried the below query, but it produced nothing. Can someone help?</P><P>index=* sourcetype=cpu CPU=all host=* earliest=-35m | rename "%_Idle_Time" as Percent_Idle_Time | eval CpuUsage=coalesce(100-Percent_Idle_Time,100-PercentIdleTime) | streamstats count by host | where count&lt;=6 | stats avg(values(CpuUsage)) as "Average of CpuUsage last 6 intervals(5mins range)" by host</P><P>&nbsp;</P><P>Regards,<BR />Satheesh</P><P>&nbsp;</P><P>&nbsp;</P><P>&nbsp;</P> Fri, 28 Jul 2023 04:15:37 GMT Satheesh_red 2023-07-28T04:15:37Z averaging the CPU values from the recent six events https://community.splunk.com/t5/Splunk-Search/averaging-the-CPU-values-from-the-recent-six-events/m-p/652302#M225455 <P>Hi,</P><P>I'm attempting to calculate the average of the last six CPU event values. If the average of those six events is greater than 95%, an alert must be sent. I basically tried the below query, but it produced nothing. Can someone help?</P><P>index=* sourcetype=cpu CPU=all host=* earliest=-35m | rename "%_Idle_Time" as Percent_Idle_Time | eval CpuUsage=coalesce(100-Percent_Idle_Time,100-PercentIdleTime) | streamstats count by host | where count&lt;=6 | stats avg(values(CpuUsage)) as "Average of CpuUsage last 6 intervals(5mins range)" by host</P><P>&nbsp;</P><P>Regards,<BR />Satheesh</P><P>&nbsp;</P><P>&nbsp;</P><P>&nbsp;</P> Fri, 28 Jul 2023 04:15:37 GMT https://community.splunk.com/t5/Splunk-Search/averaging-the-CPU-values-from-the-recent-six-events/m-p/652302#M225455 Satheesh_red 2023-07-28T04:15:37Z Re: averaging the CPU values from the recent six events https://community.splunk.com/t5/Splunk-Search/averaging-the-CPU-values-from-the-recent-six-events/m-p/652306#M225457 <P>Try this</P><LI-CODE lang="markup">| stats avg(CpuUsage) as "Average of CpuUsage last 6 intervals(5mins range)" by host</LI-CODE> Fri, 28 Jul 2023 05:16:51 GMT https://community.splunk.com/t5/Splunk-Search/averaging-the-CPU-values-from-the-recent-six-events/m-p/652306#M225457 ITWhisperer 2023-07-28T05:16:51Z