Linux TOP load average


Hi, I am a Splunk newbie, I am attempting to create an alert that will notify if loadAvg1mi is sustained above 20 for more than one hour.  

This is how I started:

index =os host=myserver sourcetype =vmstat loadAvg1mi |where loadAvg1mi>20 | timechart avg(loadAvg1mi)

But I have no idea how to add the sustained over 1 hour.

Any ideas would be apprecieated.


Labels (1)
0 Karma


Hi @juliedba,

It think your loadAvg1mi logs are coming every minutes. After filtering the values that above 20, you can use count per hour. Please try below sample for all your hosts;

index=os sourcetype=vmstat loadAvg1mi 
| where loadAvg1mi>20 
| timechart span=1h count(loadAvg1mi) as count by host
| where count > 60


If this reply helps you an upvote is appreciated.
0 Karma
.conf21 CFS Extended through 5/20!

Don't miss your chance
to share your Splunk
wisdom in-person or
virtually at .conf21!

Call for Speakers has
been extended through
Thursday, 5/20!