Hello Splunk Experts, I have an issue with measuring the CPU load in a Linux box.  With the below query, I am getting a high CPU usage when there were no activities running on Linux Server. Actually, the server status is pretty much an Idea most of the time and it is being used as a backup server. cpu_load = 100 - PercentIdleTime;    eval cpu_load = 100 - PercentIdleTime | stats avg(cpu_load) as "CPUUsage" by host | eval "CPUUsage"=round('CPUUsage', 2) | where CPUUsage>90     ... View more

Search|  table ERROR_CD, HAWB, UREF, LRN, MRN, ER1_ER9_Details Splunk Alert: "$results.ERROR_CD$ $results.HAWB$"   I am using the following value for email subject ,  returning empty.. Any advise how can use field values as email tokens?    ... View more

  Sending email alert when the error count > 0 results;  but how can include table data/values in the email alert?  ( table _time, ERROR_CD, HAWB, UREF, LRN, MRN, ER1_ER9_Details ) Query:  index=gbs_its_openshift_exp-ics2 openshift_container_name="regulatory-engine" "ER1/ER9 errors" | rex field=_raw "uref:(?<UREF>\w+)" | rex field=_raw "hawb:(?<HAWB>\w+)" | rex field=_raw "lrn:(?<LRN>\w+)" | rex field=_raw "mrn:(?<MRN>\w+)" | rex field=_raw "rrr:(?<RRR>\w+)" | rex field=_raw "ER1\/ER9\serrors:(?<ER1_ER9_Details>.+)" | rex field=_raw "Err-\[(?<ERROR_CD>\w*)\]" | table _time, ERROR_CD, HAWB, UREF, LRN, MRN, ER1_ER9_Details | stats count | search count > 0 ... View more

I am trying to get a time difference of two events and using timechart, I wants to display MAX(time difference value ) in a span of 30seconds;  Below query is working with table and I want to use timechart - Any help appreciated.  index=express_its_pds_solsup_dce sourcetype="express:dce:shipmentlog" "EWPX - WCO: Begin saving" | rex field=_raw "build.(?<SHIP_FILE>[\S+]*)" | stats latest(_time) as begin_time by SHIP_FILE | join SHIP_FILE [ search index=express_its_pds_solsup_dce sourcetype="express:dce:shipmentlog" "EWPX - WCO: End" | rex field=_raw "build.(?<SHIP_FILE>[\S+]*)" | stats latest(_time) as end_time by SHIP_FILE ] | eval ship_throughput = end_time-begin_time | table SHIP_FILE, ship_throughput ... View more