Play around with the _logpoint repo and the following queries:

For memory usage make an alert on the use field here:

source_name="/opt/immune/var/log/system_metrics/system_metrics.log" object="Physical Memory" | fields total, free, used, use 

For cpu usage make an alert on the use field here:

source_name="/opt/immune/var/log/system_metrics/system_metrics.log" object="CPU Usage"  | fields use

For a general overview of possible metrics objects use:

source_name="/opt/immune/var/log/system_metrics/system_metrics.log" | chart count() by object