Splunk Search

Need help to write a query using Streamstats.

New Member

Hi Team,

i have onboarded the Linux CPU logs using Splunk add on for linux. the requirement is , we need send an alert when we hitting the CPU utilization more 80 % and count for the continuously 3 times. Using streamstats command

input is enabled for every 1200 seconds and alert will run every 30 mintues.

Could you please help me to get the query.

Tags (1)
0 Karma

Esteemed Legend

Like this:

... | streamstats current=t window=3 count(eval(cpu>=80)) AS count80plus
| where count80plus==3
0 Karma


How we did that was to pull together the list of inputs and then add a streamstats like this:

| streamstats current=t window=3 values(status) AS last_three by input_name 

Something like this:

index=_internal sourcetype=dbx_job_metrics 
| sort input_name _time 
| table input_name _time status
| streamstats current=t window=3 list(status) as last_three values(status) AS values_three by input_name 
| search values_three != "COMPLETED"

You'll need to adjust a little to get your > 80% in there.. but that's the basics of it.

0 Karma


Here's a search with numeric values - that you can look at:

index=_internal sourcetype=splunkd kb=* 
| table _time sourcetype kb 
| eval threshold = if(kb<80,"UNDER","OVER")
| streamstats current=t window=3 list(kb) as last_three list(threshold) AS all_threshholds values(threshold) AS last3_threshhold 
| eval ALERT = if(last3_threshhold != "UNDER","All 3 were OVER","")
| eval GOOD = if(last3_threshhold != "OVER","Last 3 were all good","")
0 Karma
State of Splunk Careers

Access the Splunk Careers Report to see real data that shows how Splunk mastery increases your value and job satisfaction.

Find out what your skills are worth!