How to edit my search for an alert to be triggered if a host's CPU load percentage exceeds 60%?

[xuanyun]

We use the following search to obtain information on Percent_CPU_Load.

index=os sourcetype=cpu | multikv fields pctIdle | eval Percent_CPU_Load = 100 - pctIdle | timechart avg(Percent_CPU_Load) by host

The search results show the Percent_CPU_Load of all the hosts.

I want an alert to be triggered when Percent_CPU_Load if any one of the hosts exceeds 60%.
How do I set the alert to meet the conditions above?

[martin_mueller · Accepted solution]

Try this search:

index=os sourcetype=cpu | multikv fields pctIdle | eval Percent_CPU_Load = 100 - pctIdle | stats avg(Percent_CPU_Load) as avg_cpu by host | where avg_cpu > 60

Set the alert to trigger when there is more than zero results.

[xuanyun]

Thank you very much!
That's very kind of you!