All Apps and Add-ons

Splunk Add-on for Unix and Linux: How to extract a field with rex to alert when CPU usage is greater than 70%?

sekharsidh
Engager

I have configured TA nix for our Linux systems and I need to generate an alert when CPU % goes past, lets say, 70%. I think I need to write the rex for this. This is what I am writing:

index=os source=df host = * Filesystem="/dev/mapper/osvg-appbin" OR Filesystem="/dev/mapper/vgapp-appvar" OR "/mqshare" OR "/appdata" | rex "(?\d\d%)" | where UsePct>"30%" | stats count by host,source,UsePct

But it gives me values which are 6% as well. I have very limited knowledge on rex. I need some search which will look for values from 0 % to 100% and alert me if it goes past 70%. Any suggestions will be really helpful and appreciated.

0 Karma
1 Solution

sekharsidh
Engager

I think I got the answer by doing some R&D. Here is the query which seem to work for me:

index=os source=df host = * Filesystem="/dev/mapper/osvg-appbin" OR Filesystem="/dev/mapper/vgapp-appvar" OR "/mqshare" OR "/appdata" | rex "(?\d+)%" | where UsePct>30 | stats count by host,source,UsePct

Result:

host        source  UsePct  count
XXXXXXXX    df      46      12

View solution in original post

0 Karma

sekharsidh
Engager

I think I got the answer by doing some R&D. Here is the query which seem to work for me:

index=os source=df host = * Filesystem="/dev/mapper/osvg-appbin" OR Filesystem="/dev/mapper/vgapp-appvar" OR "/mqshare" OR "/appdata" | rex "(?\d+)%" | where UsePct>30 | stats count by host,source,UsePct

Result:

host        source  UsePct  count
XXXXXXXX    df      46      12
0 Karma
Get Updates on the Splunk Community!

Why You Can't Miss .conf25: Unleashing the Power of Agentic AI with Splunk & Cisco

The Defining Technology Movement of Our Lifetime The advent of agentic AI is arguably the defining technology ...

Deep Dive into Federated Analytics: Unlocking the Full Power of Your Security Data

In today’s complex digital landscape, security teams face increasing pressure to protect sprawling data across ...

Your summer travels continue with new course releases

Summer in the Northern hemisphere is in full swing, and is often a time to travel and explore. If your summer ...