Monitoring Splunk

CPU alert when it exceeds a threshold

sunilsk1
Path Finder

index=os host=* sourcetype=cpu | lookup chipotl fqdn as host | search application_name="New Apps*" AND physical_environment_name="SystemTestWest" AND state="LIVE"| multikv fields pctUser,pctSystem,pctIowait,pctIdle,application_name | search all |sort "Sort" |eval Percent_CPU_Load=100-pctIdle| eval application=application_name |stats avg(Percent_CPU_Load) by host,application_name | where Percent_CPU_Load > 10

I want the results where the CPU is more then 10% . The above Query isn't returning any result Set.

Tags (1)
0 Karma
1 Solution

rechteklebe
Path Finder

try at the end with:

stats avg(Percent_CPU_Load) as cpu_load by host,application_name | where cpu_load > 10

View solution in original post

sunilsk1
Path Finder

the next issue , I have scheduled the alert and the complete result along with Search query is sent to all my Users.
Is there way that I can send only the Search results and hide the Query and all other log details.

0 Karma

sunilsk1
Path Finder

the next issue , I have scheduled the alert and the complete result along with Search query is sent to all my Users.
Is there way that I can send only the Search results and hide the Query and all other log details.

0 Karma

sunilsk1
Path Finder

thanks all for yours answer.
This thing worked for me by piping the data out -->
|rename avg(cpu) as cpualert|where cpualert >35

Here's the complete query that worked for me -

index=os host=* sourcetype=cpu | lookup chipotl fqdn as host | search application_name="New apps*" AND physical_environment_name="System T*" AND state="LIVE"| multikv fields pctUser,pctSystem,pctIowait,pctIdle,application_name | search all |sort "Sort" |eval cpu=100-pctIdle|stats avg(cpu) by host,application_name|rename avg(cpu) as cpualert|where cpualert >35

0 Karma

rechteklebe
Path Finder

try at the end with:

stats avg(Percent_CPU_Load) as cpu_load by host,application_name | where cpu_load > 10

sdaniels
Splunk Employee
Splunk Employee

The first thing I'd recommend is doing a pipe to table and break this thing down to make sure you're getting the numbers you think you are getting.

what is this part for - '| search all'? I'm guessing if you do the follow below you may not have any data.

index=os host= sourcetype=cpu | lookup chipotl fqdn as host | search application_name="New Apps" AND physical_environment_name="SystemTestWest" AND state="LIVE"| multikv fields pctUser,pctSystem,pctIowait,pctIdle,application_name | search all | table pctIdle, application_name

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...