Hi, I am a Splunk newbie, I am attempting to create an alert that will notify if loadAvg1mi is sustained above 20 for more than one hour.
This is how I started:
index =os host=myserver sourcetype =vmstat loadAvg1mi |where loadAvg1mi>20 | timechart avg(loadAvg1mi)
But I have no idea how to add the sustained over 1 hour.
Any ideas would be apprecieated.
Thanks
Hi @juliedba,
It think your loadAvg1mi logs are coming every minutes. After filtering the values that above 20, you can use count per hour. Please try below sample for all your hosts;
index=os sourcetype=vmstat loadAvg1mi
| where loadAvg1mi>20
| timechart span=1h count(loadAvg1mi) as count by host
| where count > 60