index=os host=* sourcetype=cpu | lookup chipotl fqdn as host | search application_name="New Apps*" AND physical_environment_name="SystemTestWest" AND state="LIVE"| multikv fields pctUser,pctSystem,pctIowait,pctIdle,application_name | search all |sort "Sort" |eval Percent_CPU_Load=100-pctIdle| eval application=application_name |stats avg(Percent_CPU_Load) by host,application_name | where Percent_CPU_Load > 10
I want the results where the CPU is more then 10% . The above Query isn't returning any result Set.
try at the end with:
stats avg(Percent_CPU_Load) as cpu_load by host,application_name | where cpu_load > 10
the next issue , I have scheduled the alert and the complete result along with Search query is sent to all my Users.
Is there way that I can send only the Search results and hide the Query and all other log details.
the next issue , I have scheduled the alert and the complete result along with Search query is sent to all my Users.
Is there way that I can send only the Search results and hide the Query and all other log details.
thanks all for yours answer.
This thing worked for me by piping the data out -->
|rename avg(cpu) as cpualert|where cpualert >35
Here's the complete query that worked for me -
index=os host=* sourcetype=cpu | lookup chipotl fqdn as host | search application_name="New apps*" AND physical_environment_name="System T*" AND state="LIVE"| multikv fields pctUser,pctSystem,pctIowait,pctIdle,application_name | search all |sort "Sort" |eval cpu=100-pctIdle|stats avg(cpu) by host,application_name|rename avg(cpu) as cpualert|where cpualert >35
try at the end with:
stats avg(Percent_CPU_Load) as cpu_load by host,application_name | where cpu_load > 10
The first thing I'd recommend is doing a pipe to table and break this thing down to make sure you're getting the numbers you think you are getting.
what is this part for - '| search all'? I'm guessing if you do the follow below you may not have any data.
index=os host= sourcetype=cpu | lookup chipotl fqdn as host | search application_name="New Apps" AND physical_environment_name="SystemTestWest" AND state="LIVE"| multikv fields pctUser,pctSystem,pctIowait,pctIdle,application_name | search all | table pctIdle, application_name