Why Splunk ITSI Incident creation with average CPU not working?

[vigneshr]

Hi Guys,  Looking for some support on this. We are trying to setup alerts for the CPU metric data, to have incident when average CPU usage reaches over 90% for over last 2 hours. 

We created a following base search,
| mstats avg(cpu_metric.pctIdle) as cpu_idle  where index=lxmetrics earliest=-4h latest=now() span=2h by host| eval cpu_used=round(100-cpu_idle,2)

Problem, incidents created as soon CPU is over 90% when KPI search schedule reaches(15mins). It is not waiting for 2 hours to complete, to take the average. Need some light on this. Thanks

[mcederhage_splu]

Can you work within the time windows that ITSI provide?

Will make things easier to understand.

What i think you are hitting is that the latest time bucket created by span will be partial.  Compare with the timechart switch partial=f

If you want to solve it using time modifiers you might need to use the snap-to function instead of now()

https://docs.splunk.com/Documentation/SCS/current/Search/Specifyrelativetime#3._Specify_a_snap-to_ti...