I have researched this issue and found a few solutions, though not completely. I followed this link:
and wanted to know if I can use "%ProcessorTime" instead of CPUPct as I am not able to extract "CPUPct" field.
Also, I followed this link: https://answers.splunk.com/answers/693250/how-do-i-alert-if-cpu-is-greater-than-97-for-more.html
here, I wanted to understand what does "instance=Total" mean?
Also, which one of the accepted answers is better to use? The queries I used are as follows:
index="perfmoncpu" | bin time span=1m
| stats max(%Processor_Time) as PercentProcessorTime by host _time
| eval PercentProcessorTime = round(PercentProcessorTime, 2)
| eval overload = if(PercentProcessorTime >= 90, 1, 0)
|streamstats current=f last(overload) as prevload by host
|eval newgroup=case(isnull(prevload),1, prevload!=overload,1, true(),0)
|streamstats sum(newgroup) as groupno by host
|eventstats count as LoadDuration by host groupno
| where overload = 1 and LoadDuration >= 10
| table host _time PercentProcessorTime LoadDuration
index="perfmoncpu" source="PerfmonMk:CPU" instance=Total
| sort 0 _time
| streamstats timewindow=15min avg(cpuloadpercent) as last15minload count by host
| eval last15minload = if (count < 90,null,round(last15minload, 2))
| where (last15minload) >= 90
| table host, cpuloadpercent, last15min_load
I have used count<90 as the above SPL generates a count of 90 mins throughout
Please let me know if you guys have any further questions.
PS: I am a newbie trying to learn splunk!
instance=_Total is instance field has
%_Processor_Time can be used by field name.
try both and check job inspector.
If you provide sample logs, we can make query.
Hi @to4kawa ,
Thank you for your response. I am using both, however, am not sure what exactly to check in job inspector that will give me the idea that the SPL is correct.
Regarding logs, am trying to find a way to submit them. I will try and add a link to it.