https://community.splunk.com/t5/All-Apps-and-Add-ons/Splunk-App-for-Unix-and-Linux-Dashboard-statistics-table-to-show/m-p/290474#M34659 <P>If you wanted both CPU and Memory you could use a where clause such as:</P> <PRE><CODE>(index=os host=* source=ps) process_name!="-bash"| stats avg(process_cpu_used_percent) AS avgCPUUsed by process_name, host | where avgCPUUsed &gt; 85 | rename avgCPUUsed AS "% CPU Used by Process" </CODE></PRE> <P>where is documented <A href="https://docs.splunk.com/Documentation/SplunkCloud/latest/SearchReference/Where">here</A> and stats is documented <A href="http://docs.splunk.com/Documentation/Splunk/latest/SearchReference/Stats">here</A> , you can split your stats command by multiple fields if you wish and you can use boolean logic in your where clause.<BR /> So you may want to do avgCPUUsed&gt;85 AND avgMemUsed &gt; 85 (or similar)</P> Tue, 10 Oct 2017 14:08:34 GMT gjanders 2017-10-10T14:08:34Z https://community.splunk.com/t5/All-Apps-and-Add-ons/Splunk-App-for-Unix-and-Linux-Dashboard-statistics-table-to-show/m-p/290473#M34658 <P>Dashboard statistics table for Processes that consume &gt; 85% of hosts memory and cpu. </P> <P>Ideally I'd like to Show results by process name, host, % memory used, % cpu used to notify which are my top offender process causing host performance issues. </P> <P>Working with this query so far for my linux hosts : </P> <P>(index=os host=* source=ps) process_name!="-bash"| stats count as avg(process_cpu_used_percent) by process_name, host | rename "avg(process_cpu_used_percent)" as "% CPU Used by Process"</P> <P>working with this saved search so far for windows hosts : </P> <P>index=perfmon earliest=-15m source="Perfmon:Process" counter="% Processor Time" (instance!="_Total" AND instance!="Idle" AND instance!="System") | eventstats avg(Value) as AvgValue by host,instance | top instance by AvgValue,host limit=10 showperc=f showcount=f| sort -host,-AvgValue</P> Tue, 29 Sep 2020 16:07:33 GMT https://community.splunk.com/t5/All-Apps-and-Add-ons/Splunk-App-for-Unix-and-Linux-Dashboard-statistics-table-to-show/m-p/290473#M34658 johnward4 2020-09-29T16:07:33Z https://community.splunk.com/t5/All-Apps-and-Add-ons/Splunk-App-for-Unix-and-Linux-Dashboard-statistics-table-to-show/m-p/290474#M34659 <P>If you wanted both CPU and Memory you could use a where clause such as:</P> <PRE><CODE>(index=os host=* source=ps) process_name!="-bash"| stats avg(process_cpu_used_percent) AS avgCPUUsed by process_name, host | where avgCPUUsed &gt; 85 | rename avgCPUUsed AS "% CPU Used by Process" </CODE></PRE> <P>where is documented <A href="https://docs.splunk.com/Documentation/SplunkCloud/latest/SearchReference/Where">here</A> and stats is documented <A href="http://docs.splunk.com/Documentation/Splunk/latest/SearchReference/Stats">here</A> , you can split your stats command by multiple fields if you wish and you can use boolean logic in your where clause.<BR /> So you may want to do avgCPUUsed&gt;85 AND avgMemUsed &gt; 85 (or similar)</P> Tue, 10 Oct 2017 14:08:34 GMT https://community.splunk.com/t5/All-Apps-and-Add-ons/Splunk-App-for-Unix-and-Linux-Dashboard-statistics-table-to-show/m-p/290474#M34659 gjanders 2017-10-10T14:08:34Z