Alerting

Help with query, transactions and percentage. Need it for Alerting.

Rialf1959
Explorer

Hello, I need help with this query. Cpu_percent field return values in percentage, so it might be a problem.
Basically i need to find all containers where cpu_percent usage is above 50% during 5mins and print some fields. I need it for realtime alerting. I am using ta-dockerstats addon.
This is my first query 😞

My example:

index=main source="docker_stats" host=* |stats last(cpu_percent) as CPU by container_id |where CPU> 30 | transaction host, container_id, CPU > 30 maxpause=5m | where duration>300 | fields _time, duration, host, CPU, container_id

Thanks

Tags (1)
0 Karma

woodcock
Esteemed Legend

DO NOT use realtime for this. Not only will it not work properly, but it kills your performance.

0 Karma

cmerriman
Super Champion

Alright, so from what i can see, it looks like you're filtering out the cpu_percent that's greater than 30% by container_id and then running a transaction where the events are 5 minutes apart and also only last 5 minutes.

Is this an alert running every 5 minutes? if so, try something like this:

index=main source="docker_stats" host=* earliest=-5m|stats last(cpu_percent) as CPU by container_id |search CPU>50| fields _time, host, CPU, container_id

if you need it ran for a longer duration of time:

index=main source="docker_stats" host=*|eventstats last(cpu_percent) as CPU by container_id| transaction host, container_id maxspan=5m maxpause=5m|search CPU>50 | fields _time, duration, host, CPU, container_id
0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...