Anyway, supposing that you already have the data in an index (otherwise you have to start from the beginning your approach to Splunk), you have to create the main search to use both for the dashboard and the alert.
Remember that everything in Splunk starts from a search!
so you have to find your search having something like this:
(I suppose that you already extracted fields, otherwise you have to do this before.)
Taking the above search you can save it in a dashboard's panel, adding also some filter; in this way you have your dashboard, that you could also enrich adding some statistics (e.g. a pie chart or an Histogram) from the same main search, something like this:
| stats count BY InstanceType
| bin CPUCreditBalance span=5
| stats count BY CPUCreditBalance
About the alert, you can use the same search adding a condition:
| table InstanceID InstanceType CPUCreditBalance
| where CPUCreditBalance<30
and saving it as an alert configured to send an eMail; to do this you have to follow the guided procedure after "Save as an alert".