Alerting

How to write a search query for CPU

jackin
Path Finder

Hi,

I am trying to create a alert for cpu usage by using below query,

index=os host=cbtsv 
| stats latest(*) as * by host
| table _time cpu_load_percent cpu_user_percent
| eval CPU=cpu_load_percent+cpu_user_percent|stats avg(CPU) as percent by host

here Ii am trying to add 2 fields (CPU=CPU load + cpu user)
but it is not giving results as expected
I want an alert to be triggered when Avg value of CPU=(cpu_load + cpu user) exceeds 90%.
How do I set the alert to meet the conditions above?

Final output like

Timestamp

Hostname

CPU

Status

28/02/2022 21:58:00cbtsv90%Critical

 

Labels (2)
0 Karma
1 Solution

gcusello
SplunkTrust
SplunkTrust

Hi @jackin,

I suppose that you're taking logs using the Splunk_TA-nix.

Anyway, please try a search like this:

index=os host=cbtsv 
| stats avg(cpu_load_percent) as cpu_load_percent avg(cpu_user_percent) AS cpu_user_percent BY host
| eval CPU=cpu_load_percent+cpu_user_percent
| table host CPU

Ciao.

Giuseppe

View solution in original post

somesoni2
SplunkTrust
SplunkTrust

Give this a try

index=os host=cbtsv 
| table _time cpu_load_percent cpu_user_percent 
| stats max(_time) as _time avg(cpu_load_percent) as cpu_load_percent avg(cpu_user_percent) AS cpu_user_percent 
 by host
| eval CPU=cpu_load_percent+cpu_user_percent 
| where CPU>90 | eval Status="Critical" | eval CPU=CPU."%" rename host as Hostname
| table _time Hostname CPU Status

gcusello
SplunkTrust
SplunkTrust

Hi @jackin,

I suppose that you're taking logs using the Splunk_TA-nix.

Anyway, please try a search like this:

index=os host=cbtsv 
| stats avg(cpu_load_percent) as cpu_load_percent avg(cpu_user_percent) AS cpu_user_percent BY host
| eval CPU=cpu_load_percent+cpu_user_percent
| table host CPU

Ciao.

Giuseppe

Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...