The alarm time statistics

[laiyongmao]

Now that there is such a demand, I set up an alarm, when I CPU use rate of more than 90% began to alarm, when the CPU utilization rate of less than 90% is to lift the alarm, the alarm time can be counted a total of ?I don't know Splunk can achieve now, who can help me?

[laiyongmao · Accepted solution]

The problem has been solved.

[laiyongmao]

thanks jtrucks!
I want to know about an event to another event, such as the int/0 down to int/0 up the time.

13-12-5 上午11时32分59.000秒 int/0 down
13-12-5 上午11时32分57.000秒 int/1 up
13-12-5 上午11时32分56.000秒 int/1 down
13-12-5 上午11时19分29.000秒 int/0 up
13-12-5 上午11时19分29.000秒 int/2 down
13-12-5 上午11时16分47.000秒 int/0 down

thank you very much! What are you chatting tool? How can I contact you?

[jtrucks]

Please provide examples of the log events for each of these states: alarm triggered, alarm canceled.

With the format of the logs, we can help you create a transaction based query to answer this question.