Splunk Search

averaging the CPU values from the recent six events

Satheesh_red
Path Finder

Hi,

I'm attempting to calculate the average of the last six CPU event values. If the average of those six events is greater than 95%, an alert must be sent. I basically tried the below query, but it produced nothing. Can someone help?

index=* sourcetype=cpu CPU=all host=* earliest=-35m | rename "%_Idle_Time" as Percent_Idle_Time | eval CpuUsage=coalesce(100-Percent_Idle_Time,100-PercentIdleTime) | streamstats count by host | where count<=6 | stats avg(values(CpuUsage)) as "Average of CpuUsage last 6 intervals(5mins range)" by host

 

Regards,
Satheesh

 

 

 

Labels (2)
0 Karma
1 Solution

ITWhisperer
SplunkTrust
SplunkTrust

Try this

| stats avg(CpuUsage) as "Average of CpuUsage last 6 intervals(5mins range)" by host

View solution in original post

ITWhisperer
SplunkTrust
SplunkTrust

Try this

| stats avg(CpuUsage) as "Average of CpuUsage last 6 intervals(5mins range)" by host
Get Updates on the Splunk Community!

Why You Can't Miss .conf25: Unleashing the Power of Agentic AI with Splunk & Cisco

The Defining Technology Movement of Our Lifetime The advent of agentic AI is arguably the defining technology ...

Deep Dive into Federated Analytics: Unlocking the Full Power of Your Security Data

In today’s complex digital landscape, security teams face increasing pressure to protect sprawling data across ...

Your summer travels continue with new course releases

Summer in the Northern hemisphere is in full swing, and is often a time to travel and explore. If your summer ...