Check Multiple Pre-defined Searches and Return one value

[chamil3001]

Heres what i want to do.

Scenario,
Monitor threshold breaches of CPU,HDD and memory etc

1) I have multiple searches written for each of the above and they work ok.

Eg1: host="MYHOST1" sourcetype="Perfmon:LogicalDisk_FreeSpace" NOT instance=_Total | eval Value=round(100-Value,2) | sort -_time -Value | head 1 | table Value |sort limit=1 Value| rangemap field="Value" low=0-30 elevated=31-60 default=severe

Eg2: host="MYHOST1" source="Perfmon:Total_Processor_Time" counter="% Processor Time" |eval myvalues = round(Value, 2) | table myvalues |rename myvalues as "CPU Utilzation" |sort limit=1 myvalues |rangemap field="CPU Utilzation" low=0-30 elevated=31-60 default=severe

2) Now I want to check both(or multiple) of the above searches at the same time and return a value.

Eg: "Threasholds Breached!"

Thanks in Advance!
Chamil

[kristian_kolb]

martin_mueller's idea exemplified;

For reasons of simplicity, this search looks at host fields, and gives you a single value if either part of the search (values h1 or h2) returns the "myhost".

index=blah  | head 1 | stats first(host) as h1 
|appendcols [search index=meh | head 1 |stats first(host) as h2 ] 
| eval host_value = if((h1=="myhost") OR (h2=="myhost"), "myhost", "not_myhost") 

/k

[chamil3001]

managed to get it to work using multiple Eval commands and nested "if" functions.. thanks

[chamil3001]

Thank you for the quick response! Appreciate it very much..

I will check it out
Just came home from office after trying to solve this all day 🙂

[martin_mueller]

You could append them all into one big search, and alert if at least one is breached.

[chamil3001]

yeah.. got it to work, but still need to do some tuning..

[chamil3001]

Thank you for the quick response! Appreciate it very much..