Heres what i want to do.
Scenario,
Monitor threshold breaches of CPU,HDD and memory etc
1) I have multiple searches written for each of the above and they work ok.
Eg1: host="MYHOST1" sourcetype="Perfmon:LogicalDisk_FreeSpace" NOT instance=_Total | eval Value=round(100-Value,2) | sort -_time -Value | head 1 | table Value |sort limit=1 Value| rangemap field="Value" low=0-30 elevated=31-60 default=severe
Eg2: host="MYHOST1" source="Perfmon:Total_Processor_Time" counter="% Processor Time" |eval myvalues = round(Value, 2) | table myvalues |rename myvalues as "CPU Utilzation" |sort limit=1 myvalues |rangemap field="CPU Utilzation" low=0-30 elevated=31-60 default=severe
2) Now I want to check both(or multiple) of the above searches at the same time and return a value.
Eg: "Threasholds Breached!"
Thanks in Advance!
Chamil
martin_mueller's idea exemplified;
For reasons of simplicity, this search looks at host
fields, and gives you a single value if either part of the search (values h1 or h2) returns the "myhost".
index=blah | head 1 | stats first(host) as h1
|appendcols [search index=meh | head 1 |stats first(host) as h2 ]
| eval host_value = if((h1=="myhost") OR (h2=="myhost"), "myhost", "not_myhost")
/k
managed to get it to work using multiple Eval commands and nested "if" functions.. thanks
Thank you for the quick response! Appreciate it very much..
I will check it out
Just came home from office after trying to solve this all day 🙂
You could append them all into one big search, and alert if at least one is breached.
yeah.. got it to work, but still need to do some tuning..
Thank you for the quick response! Appreciate it very much..