Multiple queries.

[biec1]

index=index_name earliest=-30m@m latest=now
| stats latest(_time) as _time avg(cpu_usage) as cpu_usage by host
| eval var1=if(cpu_usage > 30,0,1)
| table host var1 cpu_usage _time

This query gets the average cpu utilization for the past 30 minutes.
I would like to create the list of high cpu utilization hosts for the past 12 hours, based on the var1 result of above 30 minutes average.

[Richfez]

You have most of this answer already. You just need to extend your time period to 12 hours, bin the results into 30 minute buckets before your stats, then do your stats by both host AND time.

Reformatting for better readability (since it's now longer).

index=index_name earliest=-12h@h latest=now 
| bin span=30m _time 
| stats latest(_time) as _time avg(cpu_usage) as cpu_usage by host _time 
| eval var1=if(cpu_usage > 30,0,1) 
| table host var1 cpu_usage _time

Give that a shot, let us know how well it works!

Happy Splunking,
Rich

[DalJeanis]

@rich7177

| stats latest(_time) as _time ... by host _time

???

[DalJeanis · Accepted solution]

We've modified your code to run for each half hour period across 12 hours, and to output var1=1 when High...

index=index_name earliest=-12h@h latest=@30m
| bin _time span=30m
| stats avg(cpu_usage) as cpu_usage by host _time 
| eval var1=if(cpu_usage > 30,1,0) 
| table host var1 cpu_usage _time

Then, if you want ONLY the periods of high utilization, use...

| where var1==1

Then, if you want ONLY a list of the CPUs that were High at some point in the last 12 hours, and the record for the latest _time they were High, use...

| where var1==1
| sort 0 -_time
| dedup host 

Or, if you want to see the entire timeline for the last 12 hours for every CPU that reached "High" at any point in that time, use...

| eventstats sum(var1) as HighPeriodCount
| where HighPeriodCount>0