Splunk Search

Windows monitoring- high CPU % process - Splunk Alert

dkgs
Communicator

Hello,

I wanted to setup alert in Splunk cloud  for windows machines when CPU% is greater than 90. 

Please do  help how to set up the same.

My query is not working properly as expected.

index="index1" host=windows1 source="WMI:ProcessesCPU" | WHERE NOT Name="_Total" | WHERE NOT Name="System" | WHERE NOT Name="Idle" | streamstats dc(_time) as distinct_times | head (distinct_times == 1) | stats latest(PercentProcessorTime) as CPU% by Name | sort -ProcessorTime |eval AlertStatus=if('CPU%'> 90, "Alert", "Ignore") |search AlertStatus="Alert"

Inputs.conf file configurations

[WMI:ProcessesCPU]
interval = 60
wql = SELECT Name, PercentProcessorTime, PercentPrivilegedTime, PercentUserTime, ThreadCount FROM Win32_PerfFormattedData_PerfProc_Process WHERE PercentProcessorTime>0
disabled = 0

Labels (5)
Tags (4)
0 Karma

to4kawa
Ultra Champion

index="index1" host=windows1 source="WMI:ProcessesCPU" PercentProcessorTime > 90

How about this?

0 Karma

dkgs
Communicator

@to4kawa  thank you for the response.But this won't help.  Different processes will be coming in PercentProcessorTime. We need to check the total cpu % greater than 90.

Any other way ? Please do suggest

0 Karma

to4kawa
Ultra Champion

what's total?
sum? average? other?

0 Karma

dkgs
Communicator

@to4kawa  Total of all CPU processes in the windows machine.  I am also confused whether to take sum or average in this case. Normally how we see as total cpu % in task manager in a windows machine . Also we need to check for real time

Below is the wql query written in wmi file

wql = SELECT Name, PercentProcessorTime, PercentPrivilegedTime, PercentUserTime, ThreadCount FROM Win32_PerfFormattedData_PerfProc_Process WHERE PercentProcessorTime>0 

0 Karma

to4kawa
Ultra Champion

well, why do you use `| WHERE NOT Name="_Total"` ?

_Total is total cpu usage. so, I asked you.

in wql. where ... AND Name="_Total" is simple solution.

dkgs
Communicator

@to4kawa  Thank you for the help.

Also there is a requirement to find the high cpu consumption process not the total cpu % , how the query should be and what should be the wql query/  configuration file changes.

Thanks in advance

0 Karma
Get Updates on the Splunk Community!

Happy CX Day to our Community Superheroes!

Happy 10th Birthday CX Day!What is CX Day? It’s a global celebration recognizing innovation and success in the ...

Check out This Month’s Brand new Splunk Lantern Articles

Splunk Lantern is a customer success center providing advice from Splunk experts on valuable data insights, ...

Routing Data to Different Splunk Indexes in the OpenTelemetry Collector

This blog post is part of an ongoing series on OpenTelemetry. The OpenTelemetry project is the second largest ...