How to get average CPU utilization and create an alert?

[amitrai197]

I am new to Splunk.
I have tried to add CPU data locally in Splunk, and I am able to get data core-wise but I need average CPU utilization. How I can do this?

04/27/2020 23:09:19.414 +0530
11:09:19.414 PM

collection=cpu12
object="TCPIP Performance Diagnostics (Per-CPU)"
counter="TCP current connections"
instance=CPU3
Value=7
Collapse
host = *
source = Perfmon:cpu12
sourcetype = Perfmon:cpu12

04/27/2020 23:09:19.414 +0530
11:09:19.414 PM

collection=cpu12
object="TCPIP Performance Diagnostics (Per-CPU)"
counter="TCP current connections"
instance=CPU2
Value=6
Collapse
host = *
source = Perfmon:cpu12
sourcetype = Perfmon:cpu12

04/27/2020 23:09:19.414 +0530
11:09:19.414 PM

collection=cpu12
object="TCPIP Performance Diagnostics (Per-CPU)"
counter="TCP current connections"
instance=CPU1
Value=7
Collapse
host = *
source = Perfmon:cpu12
sourcetype = Perfmon:cpu12

04/27/2020 23:09:19.414 +0530
11:09:19.414 PM

collection=cpu12
object="TCPIP Performance Diagnostics (Per-CPU)"
counter="TCP current connections"
instance=CPU0
Value=8
Collapse
host = *
source = Perfmon:cpu12
sourcetype = Perfmon:cpu12

thanks

[DalJeanis]

First, you need to be regularly ingesting that data. connections is not CPU utilization, usually, but let's suppose it was.

Then, you do this -

 Your search that gets just those events across time
 | stats avg(Value) as Value by host instance 

That gets you the average for each instance. Then you average again across instances

 | stats avg(Value) as Value by host

However, depending on your monitoring software, there may also be another record there that contains the overall host information, regardless of instance. Check for that first.