Play around with the
 
  _logpoint
 
 repo and the following queries:
 For memory usage make an alert on the
 
  use
 
 field here:
source_name="/opt/immune/var/log/system_metrics/system_metrics.log" object="Physical Memory" | fields total, free, used, use 
For cpu usage make an alert on the use field here:
source_name="/opt/immune/var/log/system_metrics/system_metrics.log" object="CPU Usage"  | fields use
For a general overview of possible metrics objects use:
source_name="/opt/immune/var/log/system_metrics/system_metrics.log" | chart count() by object
1 comment