averaging the CPU values from the recent six events

[Satheesh_red]

Hi,

I'm attempting to calculate the average of the last six CPU event values. If the average of those six events is greater than 95%, an alert must be sent. I basically tried the below query, but it produced nothing. Can someone help?

index=* sourcetype=cpu CPU=all host=* earliest=-35m | rename "%_Idle_Time" as Percent_Idle_Time | eval CpuUsage=coalesce(100-Percent_Idle_Time,100-PercentIdleTime) | streamstats count by host | where count<=6 | stats avg(values(CpuUsage)) as "Average of CpuUsage last 6 intervals(5mins range)" by host

Regards,
Satheesh

[ITWhisperer · Accepted solution]

Try this

| stats avg(CpuUsage) as "Average of CpuUsage last 6 intervals(5mins range)" by host