Splunk Search

Calculate time server CPU above alert percentage



I need to track the number of times and duration where the CPU used percent is above a threshold number.

The search below shows a server that exceeds the threshold for 3 periods over the last 3 days.  What I want to get is a result that shows me the number of times the threshold has been exceeded and for how long.


I have tried using 'streamstats' and 'bin' but am not entirely sure how to achieve my goal.


Labels (1)
0 Karma
Get Updates on the Splunk Community!

Index This | Why do they call it hyper text?

November 2023 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

State of Splunk Careers 2023: Career Resilience and the Continued Value of Splunk

For the past three years, Splunk has partnered with Enterprise Strategy Group to conduct a survey that gauges ...

The Great Resilience Quest: 9th Leaderboard Update

The ninth leaderboard update (11.9-11.22) for The Great Resilience Quest is out >> Kudos to all the ...