Splunk Search

Windows monitoring- high CPU % process - Splunk Alert

dkgs
Communicator

Hello,

I wanted to setup alert in Splunk cloud  for windows machines when CPU% is greater than 90. 

Please do  help how to set up the same.

My query is not working properly as expected.

index="index1" host=windows1 source="WMI:ProcessesCPU" | WHERE NOT Name="_Total" | WHERE NOT Name="System" | WHERE NOT Name="Idle" | streamstats dc(_time) as distinct_times | head (distinct_times == 1) | stats latest(PercentProcessorTime) as CPU% by Name | sort -ProcessorTime |eval AlertStatus=if('CPU%'> 90, "Alert", "Ignore") |search AlertStatus="Alert"

Inputs.conf file configurations

[WMI:ProcessesCPU]
interval = 60
wql = SELECT Name, PercentProcessorTime, PercentPrivilegedTime, PercentUserTime, ThreadCount FROM Win32_PerfFormattedData_PerfProc_Process WHERE PercentProcessorTime>0
disabled = 0

Labels (5)
Tags (4)
0 Karma

to4kawa
Ultra Champion

index="index1" host=windows1 source="WMI:ProcessesCPU" PercentProcessorTime > 90

How about this?

0 Karma

dkgs
Communicator

@to4kawa  thank you for the response.But this won't help.  Different processes will be coming in PercentProcessorTime. We need to check the total cpu % greater than 90.

Any other way ? Please do suggest

0 Karma

to4kawa
Ultra Champion

what's total?
sum? average? other?

0 Karma

dkgs
Communicator

@to4kawa  Total of all CPU processes in the windows machine.  I am also confused whether to take sum or average in this case. Normally how we see as total cpu % in task manager in a windows machine . Also we need to check for real time

Below is the wql query written in wmi file

wql = SELECT Name, PercentProcessorTime, PercentPrivilegedTime, PercentUserTime, ThreadCount FROM Win32_PerfFormattedData_PerfProc_Process WHERE PercentProcessorTime>0 

0 Karma

to4kawa
Ultra Champion

well, why do you use `| WHERE NOT Name="_Total"` ?

_Total is total cpu usage. so, I asked you.

in wql. where ... AND Name="_Total" is simple solution.

dkgs
Communicator

@to4kawa  Thank you for the help.

Also there is a requirement to find the high cpu consumption process not the total cpu % , how the query should be and what should be the wql query/  configuration file changes.

Thanks in advance

0 Karma
Get Updates on the Splunk Community!

Take Your Breath Away with Splunk Risk-Based Alerting (RBA)

WATCH NOW!The Splunk Guide to Risk-Based Alerting is here to empower your SOC like never before. Join Haylee ...

SignalFlow: What? Why? How?

What is SignalFlow? Splunk Observability Cloud’s analytics engine, SignalFlow, opens up a world of in-depth ...

Federated Search for Amazon S3 | Key Use Cases to Streamline Compliance Workflows

Modern business operations are supported by data compliance. As regulations evolve, organizations must ...