// Alert when the average CPU usage exceeds a threshold.
// Groups by host.
// Adjust utilization threshold in the final WHERE clause as needed.
FROM metrics-system.cpu-*
| KEEP host.name, system.cpu.total.norm.pct
| STATS avg_cpu_util = AVG(system.cpu.total.norm.pct) BY host.name
| WHERE avg_cpu_util >= 0.85

// Alert when the average memory usage exceeds a threshold.
// Groups by host.
// Adjust utilization threshold in the final WHERE clause as needed.
FROM metrics-system.memory-*
| KEEP host.name, system.memory.actual.used.pct
| STATS avg_memory_util = AVG(system.memory.actual.used.pct) BY host.name
| WHERE avg_memory_util >= 0.9