Linux TOP load average

[juliedba]

Hi, I am a Splunk newbie, I am attempting to create an alert that will notify if loadAvg1mi is sustained above 20 for more than one hour.  

This is how I started:

index =os host=myserver sourcetype =vmstat loadAvg1mi |where loadAvg1mi>20 | timechart avg(loadAvg1mi)

But I have no idea how to add the sustained over 1 hour.

Any ideas would be apprecieated.

Thanks

[scelikok]

Hi @juliedba,

It think your loadAvg1mi logs are coming every minutes. After filtering the values that above 20, you can use count per hour. Please try below sample for all your hosts;

index=os sourcetype=vmstat loadAvg1mi 
| where loadAvg1mi>20 
| timechart span=1h count(loadAvg1mi) as count by host
| where count > 60