All Apps and Add-ons

Sanity Check on a tag please

daniel333
Builder

All,

So trying to make a quick tag to discover command OS metric issues. Basically I want a tag called tag=osproblem

I want it to return hosts that -
90% or higher CPU, RAM
90% disk space used
Any swap being used

Here is the start of my work. Just want to make sure there is not a smarter way of doing this before I commit to this approach -

tag=os pctCPU=* OR pctMEM=* | where pctCPU>90 OR pctMEM>90

It doesn't appear that I can use "where" in a eventtype. Any idea how I could attack this?

0 Karma
1 Solution

martin_mueller
SplunkTrust
SplunkTrust

You should be able to use tag=os (pctCPU>90 OR pctMEM>90) in an eventtype, no need for where.

View solution in original post

0 Karma

martin_mueller
SplunkTrust
SplunkTrust

You should be able to use tag=os (pctCPU>90 OR pctMEM>90) in an eventtype, no need for where.

View solution in original post

0 Karma
.conf21 Now Fully Virtual!
Register for FREE Today!

We've made .conf21 totally virtual and totally FREE! Our completely online experience will run from 10/19 through 10/20 with some additional events, too!