Alerting

How to write a search query for CPU

jackin
Path Finder

Hi,

I am trying to create a alert for cpu usage by using below query,

index=os host=cbtsv 
| stats latest(*) as * by host
| table _time cpu_load_percent cpu_user_percent
| eval CPU=cpu_load_percent+cpu_user_percent|stats avg(CPU) as percent by host

here Ii am trying to add 2 fields (CPU=CPU load + cpu user)
but it is not giving results as expected
I want an alert to be triggered when Avg value of CPU=(cpu_load + cpu user) exceeds 90%.
How do I set the alert to meet the conditions above?

Final output like

Timestamp

Hostname

CPU

Status

28/02/2022 21:58:00cbtsv90%Critical

 

Labels (2)
0 Karma
1 Solution

gcusello
SplunkTrust
SplunkTrust

Hi @jackin,

I suppose that you're taking logs using the Splunk_TA-nix.

Anyway, please try a search like this:

index=os host=cbtsv 
| stats avg(cpu_load_percent) as cpu_load_percent avg(cpu_user_percent) AS cpu_user_percent BY host
| eval CPU=cpu_load_percent+cpu_user_percent
| table host CPU

Ciao.

Giuseppe

View solution in original post

somesoni2
Revered Legend

Give this a try

index=os host=cbtsv 
| table _time cpu_load_percent cpu_user_percent 
| stats max(_time) as _time avg(cpu_load_percent) as cpu_load_percent avg(cpu_user_percent) AS cpu_user_percent 
 by host
| eval CPU=cpu_load_percent+cpu_user_percent 
| where CPU>90 | eval Status="Critical" | eval CPU=CPU."%" rename host as Hostname
| table _time Hostname CPU Status

gcusello
SplunkTrust
SplunkTrust

Hi @jackin,

I suppose that you're taking logs using the Splunk_TA-nix.

Anyway, please try a search like this:

index=os host=cbtsv 
| stats avg(cpu_load_percent) as cpu_load_percent avg(cpu_user_percent) AS cpu_user_percent BY host
| eval CPU=cpu_load_percent+cpu_user_percent
| table host CPU

Ciao.

Giuseppe

Get Updates on the Splunk Community!

Combine Multiline Logs into a Single Event with SOCK - a Guide for Advanced Users

This article is the continuation of the “Combine multiline logs into a single event with SOCK - a step-by-step ...

Everything Community at .conf24!

You may have seen mention of the .conf Community Zone 'round these parts and found yourself wondering what ...

Index This | I’m short for "configuration file.” What am I?

May 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with a Special ...