Hi @Dhanaskv,
your request is just a little vague...
Anyway, supposing that you already have the data in an index (otherwise you have to start from the beginning your approach to Splunk), you have to create the main search to use both for the dashboard and the alert.
Remember that everything in Splunk starts from a search!
so you have to find your search having something like this:
index=your_index
| table InstanceID InstanceType CPUCreditBalance
(I suppose that you already extracted fields, otherwise you have to do this before.)
Taking the above search you can save it in a dashboard's panel, adding also some filter; in this way you have your dashboard, that you could also enrich adding some statistics (e.g. a pie chart or an Histogram) from the same main search, something like this:
index=your_index
| stats count BY InstanceType
or
index=your_index
| bin CPUCreditBalance span=5
| stats count BY CPUCreditBalance
About the alert, you can use the same search adding a condition:
index=your_index
| table InstanceID InstanceType CPUCreditBalance
| where CPUCreditBalance<30
and saving it as an alert configured to send an eMail; to do this you have to follow the guided procedure after "Save as an alert".
At the end I hint to follow the Splunk Search Tutorial https://docs.splunk.com/Documentation/SplunkCloud/latest/SearchTutorial/WelcometotheSearchTutorial and the Splunk Fundamentals I training (it's free with the exception of the Certification Exam) (https://www.splunk.com/en_us/training/free-courses/splunk-fundamentals-1.html) then you can find many interesting videos on YouTube.
Ciao.
Giuseppe
