Splunk ITSI

Why Splunk ITSI Incident creation with average CPU not working?

vigneshr
New Member

Hi Guys,  Looking for some support on this. We are trying to setup alerts for the CPU metric data, to have incident when average CPU usage reaches over 90% for over last 2 hours. 

We created a following base search,
| mstats avg(cpu_metric.pctIdle) as cpu_idle  where index=lxmetrics earliest=-4h latest=now() span=2h by host| eval cpu_used=round(100-cpu_idle,2)

Problem, incidents created as soon CPU is over 90% when KPI search schedule reaches(15mins). It is not waiting for 2 hours to complete, to take the average. Need some light on this. Thanks

Labels (2)
Tags (1)
0 Karma

mcederhage_splu
Splunk Employee
Splunk Employee

Can you work within the time windows that ITSI provide?

Will make things easier to understand.

 

What i think you are hitting is that the latest time bucket created by span will be partial.  Compare with the timechart switch partial=f

If you want to solve it using time modifiers you might need to use the snap-to function instead of now()

https://docs.splunk.com/Documentation/SCS/current/Search/Specifyrelativetime#3._Specify_a_snap-to_ti...

0 Karma
Get Updates on the Splunk Community!

Prove Your Splunk Prowess at .conf25—No Prereqs Required!

Your Next Big Security Credential: No Prerequisites Needed We know you’ve got the skills, and now, earning the ...

Splunk Observability Cloud's AI Assistant in Action Series: Observability as Code

This is the sixth post in the Splunk Observability Cloud’s AI Assistant in Action series that digs into how to ...

Splunk Answers Content Calendar, July Edition I

Hello Community! Welcome to another month of Community Content Calendar series! For the month of July, we will ...