Splunk IT Service Intelligence

Why Splunk ITSI Incident creation with average CPU not working?

New Member

Hi Guys,  Looking for some support on this. We are trying to setup alerts for the CPU metric data, to have incident when average CPU usage reaches over 90% for over last 2 hours. 

We created a following base search,
| mstats avg(cpu_metric.pctIdle) as cpu_idle  where index=lxmetrics earliest=-4h latest=now() span=2h by host| eval cpu_used=round(100-cpu_idle,2)

Problem, incidents created as soon CPU is over 90% when KPI search schedule reaches(15mins). It is not waiting for 2 hours to complete, to take the average. Need some light on this. Thanks

Labels (2)
Tags (1)
0 Karma

Splunk Employee
Splunk Employee

Can you work within the time windows that ITSI provide?

Will make things easier to understand.


What i think you are hitting is that the latest time bucket created by span will be partial.  Compare with the timechart switch partial=f

If you want to solve it using time modifiers you might need to use the snap-to function instead of now()


0 Karma
Get Updates on the Splunk Community!

Improve Your Security Posture

Watch NowImprove Your Security PostureCustomers are at the center of everything we do at Splunk and security ...

Maximize the Value from Microsoft Defender with Splunk

 Watch NowJoin Splunk and Sens Consulting for this Security Edition Tech TalkWho should attend:  Security ...

This Week's Community Digest - Splunk Community Happenings [6.27.22]

Get the latest news and updates from the Splunk Community here! News From Splunk Answers ✍️ Splunk Answers is ...