well this is my generated search.
| eventstats sum(SCP1_CPU) as sum_scp1
| eventstats sum(SCP2_CPU) as sum_scp2
| eventstats sum(SCP3_CPU) as sum_scp3
| eventstats sum(SCP4_CPU) as sum_scp4
| eval avg_scp_cpu = (sum_scp1 + sum_scp2 + sum_scp3 + sum_scp4) / 4 | aggregate_raw_into_service(avg, avg_scp_cpu) | assess_severity(1e9057dc-4f5d-4abf-a773-e85349dd8a84, 840141769da338d4b0e16cdd, true, true) | eval kpi="scp cpu util3", urgency="5", alert_period="5", serviceid="1e9057dc-4f5d-4abf-a773-e85349dd8a84" | assess_urgency
When I press ctrl+shift+e it doesnt do anything at all. Maybe its cause Im on a mac?
I ran that generated search and did a search for yesterday and indeed, the alert_value is 3174. But when I run it for last 5 mins, it shows the expected 11.
This makes me wonder if somehow during backfill with this query, it is summing up the complete days worth of values. Im going to test this.
... View more