Alerting

How to get average CPU utilization and create an alert?

amitrai197
New Member

I am new to Splunk.
I have tried to add CPU data locally in Splunk, and I am able to get data core-wise but I need average CPU utilization. How I can do this?

04/27/2020 23:09:19.414 +0530
11:09:19.414 PM

collection=cpu12
object="TCPIP Performance Diagnostics (Per-CPU)"
counter="TCP current connections"
instance=CPU3
Value=7
Collapse
host = *
source = Perfmon:cpu12
sourcetype = Perfmon:cpu12

04/27/2020 23:09:19.414 +0530
11:09:19.414 PM

collection=cpu12
object="TCPIP Performance Diagnostics (Per-CPU)"
counter="TCP current connections"
instance=CPU2
Value=6
Collapse
host = *
source = Perfmon:cpu12
sourcetype = Perfmon:cpu12

04/27/2020 23:09:19.414 +0530
11:09:19.414 PM

collection=cpu12
object="TCPIP Performance Diagnostics (Per-CPU)"
counter="TCP current connections"
instance=CPU1
Value=7
Collapse
host = *
source = Perfmon:cpu12
sourcetype = Perfmon:cpu12

04/27/2020 23:09:19.414 +0530
11:09:19.414 PM

collection=cpu12
object="TCPIP Performance Diagnostics (Per-CPU)"
counter="TCP current connections"
instance=CPU0
Value=8
Collapse
host = *
source = Perfmon:cpu12
sourcetype = Perfmon:cpu12

thanks

Labels (1)
0 Karma

DalJeanis
SplunkTrust
SplunkTrust

First, you need to be regularly ingesting that data. connections is not CPU utilization, usually, but let's suppose it was.

Then, you do this -

 Your search that gets just those events across time
 | stats avg(Value) as Value by host instance 

That gets you the average for each instance. Then you average again across instances

 | stats avg(Value) as Value by host

However, depending on your monitoring software, there may also be another record there that contains the overall host information, regardless of instance. Check for that first.

0 Karma
Did you miss .conf21 Virtual?

Good news! The event's keynotes and many of its breakout sessions are now available online, and still totally FREE!