My splunk admin said I can't use a raw search using index=. because it consumes to much resources, he told to use metrics. I have configured the inputs.conf file with the following: [script://./bin/cpu_metric.sh] sourcetype = cpu:metric interval = 60 disabled = 0 index = linux_metrics sourcetype = cpu:metric Now I'm using an index for metrics called index = linux_metrics which I created on the indexer I stopped and restarted the forwarder In the search window, I used the following query | mstats avg(_value) as avg_idle WHERE index=linux_metrics metric_name=cpu.pctIdle BY host span=1m | eval avg_cpu = 100 - avg_idle | eval is_high = if(avg_cpu > 90, 1, 0) | stats sum(is_high) as high_minutes count as total_minutes by host | where high_minutes >= 5 AND total_minutes >= 5 In Time range: 1 minute window I waited 10 minutes, I'm not getting results.     ... View more

Thank you for your suggestion LiveHybrid. I have inserted the SPL query you suggested into the 'New Search' window and I set my Time range: to 1 minute window. Then I went to the forwarder and downloaded and executed this program called stress (RedHat) which will max out the cpu utilization. I started the search but I didn't get any alerts, I waited for 10 minutes. Do you know why? ... View more

You are correct! I had to use the following code below to extract the fields. rex field=_raw "(?<pctUser>[0-9]+(?:\.[0-9]+)?)\s+(?<pctNice>[0-9]+(?:\.[0-9]+)?)\s+(?<pctSystem>[0-9]+(?:\.[0-9]+)?)\s+(?<pctIowait>[0-9]+(?:\.[0-9]+)?)\s+(?<pctIdle>[0-9]+(?:\.[0-9]+)?)" ... View more