Splunk Search

Windows monitoring- high CPU % process - Splunk Alert

dkgs
Communicator

Hello,

I wanted to setup alert in Splunk cloud  for windows machines when CPU% is greater than 90. 

Please do  help how to set up the same.

My query is not working properly as expected.

index="index1" host=windows1 source="WMI:ProcessesCPU" | WHERE NOT Name="_Total" | WHERE NOT Name="System" | WHERE NOT Name="Idle" | streamstats dc(_time) as distinct_times | head (distinct_times == 1) | stats latest(PercentProcessorTime) as CPU% by Name | sort -ProcessorTime |eval AlertStatus=if('CPU%'> 90, "Alert", "Ignore") |search AlertStatus="Alert"

Inputs.conf file configurations

[WMI:ProcessesCPU]
interval = 60
wql = SELECT Name, PercentProcessorTime, PercentPrivilegedTime, PercentUserTime, ThreadCount FROM Win32_PerfFormattedData_PerfProc_Process WHERE PercentProcessorTime>0
disabled = 0

Labels (5)
Tags (4)
0 Karma

to4kawa
Ultra Champion

index="index1" host=windows1 source="WMI:ProcessesCPU" PercentProcessorTime > 90

How about this?

0 Karma

dkgs
Communicator

@to4kawa  thank you for the response.But this won't help.  Different processes will be coming in PercentProcessorTime. We need to check the total cpu % greater than 90.

Any other way ? Please do suggest

0 Karma

to4kawa
Ultra Champion

what's total?
sum? average? other?

0 Karma

dkgs
Communicator

@to4kawa  Total of all CPU processes in the windows machine.  I am also confused whether to take sum or average in this case. Normally how we see as total cpu % in task manager in a windows machine . Also we need to check for real time

Below is the wql query written in wmi file

wql = SELECT Name, PercentProcessorTime, PercentPrivilegedTime, PercentUserTime, ThreadCount FROM Win32_PerfFormattedData_PerfProc_Process WHERE PercentProcessorTime>0 

0 Karma

to4kawa
Ultra Champion

well, why do you use `| WHERE NOT Name="_Total"` ?

_Total is total cpu usage. so, I asked you.

in wql. where ... AND Name="_Total" is simple solution.

dkgs
Communicator

@to4kawa  Thank you for the help.

Also there is a requirement to find the high cpu consumption process not the total cpu % , how the query should be and what should be the wql query/  configuration file changes.

Thanks in advance

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...