Alerting

Calculate how long CPU was high above threshold value

ips_mandar
Builder

Hi I am getting logs one/two days older in splunk and I want to create table which will show how long CPU was high above threshold value (which is user configurable from input). for ex. lets consider I want to show sources whose cpu was high 40 and in same table want to know how long time duration it was high?
Is it possible in splunk. Please advice.
logs look like

2019-11-12 01:01:04.120, per_cpu=40
2019-11-12 01:03:04.120, per_cpu=41

Thanks.

woodcock
Esteemed Legend

Like this:

... | streamstats count(eval(per_cpu<=40)) AS sessionID BY host and other fields here
| reverse
| streamstats count AS serial BY sessionID host and other fields here
| where count>1
| stats min(_time) AS _time range(_time) AS duration max(per_cpu) avg(per_cpu) BY sessionID host and other fields here
| eval duration = tostring(duration, "duration")
0 Karma

to4kawa
Ultra Champion
| makeresults count=2
| streamstats count
| eval _time = if (count==2,relative_time(_time,"-1d@m"), relative_time(_time,"@m"))
| makecontinuous span=1m
| eval per_cpu=random() % 5 + 40
| table _time per_cpu
`comment("this is sample data")`
| streamstats reset_after="per_cpu>40" count
| streamstats count(eval(per_cpu<=40)) as check_count
| eval check = if(per_cpu > 40 ,1,0)
| stats range(eval(if(check==1 AND count > 0,_time , NULL))) as duration  by check_count
| stats sum(duration) as total_duration
| eval total_duration=tostring(total_duration,"duration")

HI, how about it?

aa70627
Communicator

@to4kawa  - You're amazing. Thanks

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...