Hello,
I wanted to setup alert in Splunk cloud for windows machines when CPU% is greater than 90.
Please do help how to set up the same.
My query is not working properly as expected.
index="index1" host=windows1 source="WMI:ProcessesCPU" | WHERE NOT Name="_Total" | WHERE NOT Name="System" | WHERE NOT Name="Idle" | streamstats dc(_time) as distinct_times | head (distinct_times == 1) | stats latest(PercentProcessorTime) as CPU% by Name | sort -ProcessorTime |eval AlertStatus=if('CPU%'> 90, "Alert", "Ignore") |search AlertStatus="Alert"
Inputs.conf file configurations
[WMI:ProcessesCPU]
interval = 60
wql = SELECT Name, PercentProcessorTime, PercentPrivilegedTime, PercentUserTime, ThreadCount FROM Win32_PerfFormattedData_PerfProc_Process WHERE PercentProcessorTime>0
disabled = 0
index="index1" host=windows1 source="WMI:ProcessesCPU" PercentProcessorTime > 90
How about this?
@to4kawa thank you for the response.But this won't help. Different processes will be coming in PercentProcessorTime. We need to check the total cpu % greater than 90.
Any other way ? Please do suggest
what's total?
sum? average? other?
@to4kawa Total of all CPU processes in the windows machine. I am also confused whether to take sum or average in this case. Normally how we see as total cpu % in task manager in a windows machine . Also we need to check for real time
Below is the wql query written in wmi file
wql = SELECT Name, PercentProcessorTime, PercentPrivilegedTime, PercentUserTime, ThreadCount FROM Win32_PerfFormattedData_PerfProc_Process WHERE PercentProcessorTime>0
well, why do you use `| WHERE NOT Name="_Total"` ?
_Total is total cpu usage. so, I asked you.
in wql. where ... AND Name="_Total" is simple solution.
@to4kawa Thank you for the help.
Also there is a requirement to find the high cpu consumption process not the total cpu % , how the query should be and what should be the wql query/ configuration file changes.
Thanks in advance