Splunk query help - CPU Load - Need to change query for negative values

[splunker9999]

Hi,

We have splunk query to find CPU load like

| eval pctCPULoad=round(100 - pctIdle,2) , and we used condition if value >=95 to trigger an alert.

Here,in our case pctIdle value we have is "195",hence we are getting pctCPULoad as "-95"

Although it is -95 we are getting alerts as this is considering as 95?

Can someone help?

Thanks

[javiergn · Accepted solution]

Why don't you do it this way as having a computer idle more than 100% of the time does make too much sense?

| eval pctCPULoad=if(pctIdle >= 100, 0, round(100 - pctIdle,2))

[splunker9999]

Nice thought. Will do