Are you a member of the Splunk Community?
- Find Answers
- :
- Splunk Administration
- :
- Monitoring Splunk
- :
- Re: CPU alert when it exceeds a threshold
- Subscribe to RSS Feed
- Mark Topic as New
- Mark Topic as Read
- Float this Topic for Current User
- Bookmark Topic
- Subscribe to Topic
- Mute Topic
- Printer Friendly Page
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
index=os host=* sourcetype=cpu | lookup chipotl fqdn as host | search application_name="New Apps*" AND physical_environment_name="SystemTestWest" AND state="LIVE"| multikv fields pctUser,pctSystem,pctIowait,pctIdle,application_name | search all |sort "Sort" |eval Percent_CPU_Load=100-pctIdle| eval application=application_name |stats avg(Percent_CPU_Load) by host,application_name | where Percent_CPU_Load > 10
I want the results where the CPU is more then 10% . The above Query isn't returning any result Set.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
try at the end with:
stats avg(Percent_CPU_Load) as cpu_load by host,application_name | where cpu_load > 10
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
the next issue , I have scheduled the alert and the complete result along with Search query is sent to all my Users.
Is there way that I can send only the Search results and hide the Query and all other log details.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
the next issue , I have scheduled the alert and the complete result along with Search query is sent to all my Users.
Is there way that I can send only the Search results and hide the Query and all other log details.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
thanks all for yours answer.
This thing worked for me by piping the data out -->
|rename avg(cpu) as cpualert|where cpualert >35
Here's the complete query that worked for me -
index=os host=* sourcetype=cpu | lookup chipotl fqdn as host | search application_name="New apps*" AND physical_environment_name="System T*" AND state="LIVE"| multikv fields pctUser,pctSystem,pctIowait,pctIdle,application_name | search all |sort "Sort" |eval cpu=100-pctIdle|stats avg(cpu) by host,application_name|rename avg(cpu) as cpualert|where cpualert >35
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
try at the end with:
stats avg(Percent_CPU_Load) as cpu_load by host,application_name | where cpu_load > 10
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
The first thing I'd recommend is doing a pipe to table and break this thing down to make sure you're getting the numbers you think you are getting.
what is this part for - '| search all'? I'm guessing if you do the follow below you may not have any data.
index=os host= sourcetype=cpu | lookup chipotl fqdn as host | search application_name="New Apps" AND physical_environment_name="SystemTestWest" AND state="LIVE"| multikv fields pctUser,pctSystem,pctIowait,pctIdle,application_name | search all | table pctIdle, application_name
Take Action Automatically on Splunk Alerts with Red Hat Ansible Automation Platform
Calling All Security Pros: Ready to Race Through Boston?
Beyond Detection: How Splunk and Cisco Integrated Security Platforms Transform ...
