Splunk IT Service Intelligence

Why Splunk ITSI Incident creation with average CPU not working?

New Member

Hi Guys,  Looking for some support on this. We are trying to setup alerts for the CPU metric data, to have incident when average CPU usage reaches over 90% for over last 2 hours. 

We created a following base search,
| mstats avg(cpu_metric.pctIdle) as cpu_idle  where index=lxmetrics earliest=-4h latest=now() span=2h by host| eval cpu_used=round(100-cpu_idle,2)

Problem, incidents created as soon CPU is over 90% when KPI search schedule reaches(15mins). It is not waiting for 2 hours to complete, to take the average. Need some light on this. Thanks

Labels (2)
Tags (1)
0 Karma

Splunk Employee
Splunk Employee

Can you work within the time windows that ITSI provide?

Will make things easier to understand.


What i think you are hitting is that the latest time bucket created by span will be partial.  Compare with the timechart switch partial=f

If you want to solve it using time modifiers you might need to use the snap-to function instead of now()


0 Karma
Get Updates on the Splunk Community!

.conf24 | Day 0

Hello Splunk Community! My name is Chris, and I'm based in Canberra, Australia's capital, and I travelled for ...

Enhance Security Visibility with Splunk Enterprise Security 7.1 through Threat ...

 (view in My Videos)Struggling with alert fatigue, lack of context, and prioritization around security ...

Troubleshooting the OpenTelemetry Collector

  In this tech talk, you’ll learn how to troubleshoot the OpenTelemetry collector - from checking the ...