Hello! Try a search like this, and save it as an alert.
host=* sourcetype="Perfmon:Memory" | stats count as mem count(eval(counter="% Committed Bytes In Use")) as mem_used |eval percentage=round(mem_used/mem,3)*100 | where percentage > 80| fields mem_used, mem, percentage
Thanks!
% Committed Bytes In Use% is not the actual parameter to monitor memory.
sourcetype=perfmon* OR sourcetype=winhostmon FreePhysicalMemoryKB="*" i
| eval MemoryUsedPercent=round((TotalPhysicalMemoryKB - FreePhysicalMemoryKB)/TotalPhysicalMemoryKB * 100,2)
| eval MemoryUsedMB=(TotalPhysicalMemoryKB-FreePhysicalMemoryKB)/1024 | Stats count by host
sourcetype=perfmon* OR sourcetype=winhostmon FreePhysicalMemoryKB="*" index=<your index>
| eval MemoryUsedPercent=round((TotalPhysicalMemoryKB - FreePhysicalMemoryKB)/TotalPhysicalMemoryKB * 100,2)
| eval MemoryUsedMB=(TotalPhysicalMemoryKB-FreePhysicalMemoryKB)/1024 | stats count by host
updated the search just add your index here.