CPU alert when it exceeds a threshold

[sunilsk1]

index=os host=* sourcetype=cpu | lookup chipotl fqdn as host | search application_name="New Apps*" AND physical_environment_name="SystemTestWest" AND state="LIVE"| multikv fields pctUser,pctSystem,pctIowait,pctIdle,application_name | search all |sort "Sort" |eval Percent_CPU_Load=100-pctIdle| eval application=application_name |stats avg(Percent_CPU_Load) by host,application_name | where Percent_CPU_Load > 10

I want the results where the CPU is more then 10% . The above Query isn't returning any result Set.

[sunilsk1]

the next issue , I have scheduled the alert and the complete result along with Search query is sent to all my Users.
Is there way that I can send only the Search results and hide the Query and all other log details.

[sunilsk1]

the next issue , I have scheduled the alert and the complete result along with Search query is sent to all my Users.
Is there way that I can send only the Search results and hide the Query and all other log details.

[sunilsk1]

thanks all for yours answer.
This thing worked for me by piping the data out -->
|rename avg(cpu) as cpualert|where cpualert >35

Here's the complete query that worked for me -

index=os host=* sourcetype=cpu | lookup chipotl fqdn as host | search application_name="New apps*" AND physical_environment_name="System T*" AND state="LIVE"| multikv fields pctUser,pctSystem,pctIowait,pctIdle,application_name | search all |sort "Sort" |eval cpu=100-pctIdle|stats avg(cpu) by host,application_name|rename avg(cpu) as cpualert|where cpualert >35

[rechteklebe · Accepted solution]

try at the end with:

stats avg(Percent_CPU_Load) as cpu_load by host,application_name | where cpu_load > 10

[sdaniels]

The first thing I'd recommend is doing a pipe to table and break this thing down to make sure you're getting the numbers you think you are getting.

what is this part for - '| search all'? I'm guessing if you do the follow below you may not have any data.

index=os host= sourcetype=cpu | lookup chipotl fqdn as host | search application_name="New Apps" AND physical_environment_name="SystemTestWest" AND state="LIVE"| multikv fields pctUser,pctSystem,pctIowait,pctIdle,application_name | search all | table pctIdle, application_name