https://community.splunk.com/t5/Splunk-Enterprise/How-to-Graph-CPU-usage-of-indexers-over-time/m-p/599760#M12727 <P>I received this image from support and I would like to create a panel in my dashboard to mimic this information.&nbsp; How would I go about doing that?&nbsp; I was trying with the current query, but am not having luck.</P> <P>&nbsp;</P> <P>&nbsp;</P> <P>&nbsp;</P> <LI-CODE lang="markup">index=_introspection data.normalized_pct_cpu=* sourcetype=splunk_resource_usage host=idx* | stats avg(data.normalized_pct_cpu) AS cpu_usage BY host | table host cpu_usage</LI-CODE> <P>&nbsp;</P> <P>&nbsp;</P> <P>&nbsp;</P> <P><BR /><span class="lia-inline-image-display-wrapper lia-image-align-center" image-alt="indexer_cpu.png" style="width: 999px;"><img src="https://community.splunk.com/t5/image/serverpage/image-id/19864iDA6B548165B7A41C/image-size/large?v=v2&amp;px=999" role="button" title="indexer_cpu.png" alt="indexer_cpu.png" /></span></P> <P>&nbsp;</P> <P>I am using <STRONG>data.normalized_pct_cpu</STRONG> as the docs state that it is&nbsp;<EM>Percentage of CPU usage across all cores.&nbsp;100%</EM><SPAN><EM>&nbsp;is equivalent to all CPU resources on the machine,</EM> which seems to be what I want but not sure if that is the best way to go about this.</SPAN></P> Tue, 31 May 2022 13:54:34 GMT DEADBEEF 2022-05-31T13:54:34Z https://community.splunk.com/t5/Splunk-Enterprise/How-to-Graph-CPU-usage-of-indexers-over-time/m-p/599760#M12727 <P>I received this image from support and I would like to create a panel in my dashboard to mimic this information.&nbsp; How would I go about doing that?&nbsp; I was trying with the current query, but am not having luck.</P> <P>&nbsp;</P> <P>&nbsp;</P> <P>&nbsp;</P> <LI-CODE lang="markup">index=_introspection data.normalized_pct_cpu=* sourcetype=splunk_resource_usage host=idx* | stats avg(data.normalized_pct_cpu) AS cpu_usage BY host | table host cpu_usage</LI-CODE> <P>&nbsp;</P> <P>&nbsp;</P> <P>&nbsp;</P> <P><BR /><span class="lia-inline-image-display-wrapper lia-image-align-center" image-alt="indexer_cpu.png" style="width: 999px;"><img src="https://community.splunk.com/t5/image/serverpage/image-id/19864iDA6B548165B7A41C/image-size/large?v=v2&amp;px=999" role="button" title="indexer_cpu.png" alt="indexer_cpu.png" /></span></P> <P>&nbsp;</P> <P>I am using <STRONG>data.normalized_pct_cpu</STRONG> as the docs state that it is&nbsp;<EM>Percentage of CPU usage across all cores.&nbsp;100%</EM><SPAN><EM>&nbsp;is equivalent to all CPU resources on the machine,</EM> which seems to be what I want but not sure if that is the best way to go about this.</SPAN></P> Tue, 31 May 2022 13:54:34 GMT https://community.splunk.com/t5/Splunk-Enterprise/How-to-Graph-CPU-usage-of-indexers-over-time/m-p/599760#M12727 DEADBEEF 2022-05-31T13:54:34Z https://community.splunk.com/t5/Splunk-Enterprise/How-to-Graph-CPU-usage-of-indexers-over-time/m-p/599762#M12728 <P>Given that you graphic has a time component, perhaps this might work better for you</P><LI-CODE lang="markup">index=_introspection data.normalized_pct_cpu=* sourcetype=splunk_resource_usage host=idx* | timechart avg(data.normalized_pct_cpu) AS cpu_usage BY host</LI-CODE> Mon, 30 May 2022 16:26:33 GMT https://community.splunk.com/t5/Splunk-Enterprise/How-to-Graph-CPU-usage-of-indexers-over-time/m-p/599762#M12728 ITWhisperer 2022-05-30T16:26:33Z