https://community.splunk.com/t5/Dashboards-Visualizations/Hi-I-m-new-to-splunk-and-I-have-the-code-to-generate-a-dashboard/m-p/314167#M40027 <P>Try this (untested) search which I think may be closer to what you need:</P> <PRE><CODE>index=b2b_os sourcetype=top pctMEM=*| streamstats sum(pctMEM) as Mem |top 5 Mem | table host Mem </CODE></PRE> Mon, 22 Jan 2018 19:37:49 GMT nickhills 2018-01-22T19:37:49Z https://community.splunk.com/t5/Dashboards-Visualizations/Hi-I-m-new-to-splunk-and-I-have-the-code-to-generate-a-dashboard/m-p/314164#M40024 <P>index=b2b_os host=* sourcetype=top pctMEM=*| transaction host _time | streamstats window=1 global=f sum(pctMEM) as MEM | table host MEM |top | dedup host </P> Mon, 22 Jan 2018 16:56:08 GMT https://community.splunk.com/t5/Dashboards-Visualizations/Hi-I-m-new-to-splunk-and-I-have-the-code-to-generate-a-dashboard/m-p/314164#M40024 jampar12 2018-01-22T16:56:08Z https://community.splunk.com/t5/Dashboards-Visualizations/Hi-I-m-new-to-splunk-and-I-have-the-code-to-generate-a-dashboard/m-p/314165#M40025 <P>Hi jampar12,</P> <P>please provide us with some sample events and also your <CODE>pctMEM=</CODE> at the beginning of your search has no value assigned, as well as the host-field</P> Mon, 22 Jan 2018 19:27:56 GMT https://community.splunk.com/t5/Dashboards-Visualizations/Hi-I-m-new-to-splunk-and-I-have-the-code-to-generate-a-dashboard/m-p/314165#M40025 horsefez 2018-01-22T19:27:56Z https://community.splunk.com/t5/Dashboards-Visualizations/Hi-I-m-new-to-splunk-and-I-have-the-code-to-generate-a-dashboard/m-p/314166#M40026 <P>Also <CODE>|transaction</CODE> with <CODE>_time</CODE> will only group events which share the same exact timestamp - probably not what you want.</P> <P>Also I presume you mean memory use, rather than high CPU?</P> Mon, 22 Jan 2018 19:33:52 GMT https://community.splunk.com/t5/Dashboards-Visualizations/Hi-I-m-new-to-splunk-and-I-have-the-code-to-generate-a-dashboard/m-p/314166#M40026 nickhills 2018-01-22T19:33:52Z https://community.splunk.com/t5/Dashboards-Visualizations/Hi-I-m-new-to-splunk-and-I-have-the-code-to-generate-a-dashboard/m-p/314167#M40027 <P>Try this (untested) search which I think may be closer to what you need:</P> <PRE><CODE>index=b2b_os sourcetype=top pctMEM=*| streamstats sum(pctMEM) as Mem |top 5 Mem | table host Mem </CODE></PRE> Mon, 22 Jan 2018 19:37:49 GMT https://community.splunk.com/t5/Dashboards-Visualizations/Hi-I-m-new-to-splunk-and-I-have-the-code-to-generate-a-dashboard/m-p/314167#M40027 nickhills 2018-01-22T19:37:49Z https://community.splunk.com/t5/Dashboards-Visualizations/Hi-I-m-new-to-splunk-and-I-have-the-code-to-generate-a-dashboard/m-p/314168#M40028 <P>thank you .. it's working good now .. Just one more small ask .. </P> <P>I need to add if the Mem &gt;= 10 % then turn green and if it's &gt;=50&amp; turn yellow and if it's 90% turn red ..</P> Mon, 22 Jan 2018 20:43:16 GMT https://community.splunk.com/t5/Dashboards-Visualizations/Hi-I-m-new-to-splunk-and-I-have-the-code-to-generate-a-dashboard/m-p/314168#M40028 jampar12 2018-01-22T20:43:16Z https://community.splunk.com/t5/Dashboards-Visualizations/Hi-I-m-new-to-splunk-and-I-have-the-code-to-generate-a-dashboard/m-p/314169#M40029 <P>You can use rangemap to set the target colours for a given result, but this wont colour a table for you (you would need to modify the CSS for that) but if your using charts, this should set the colours as per your definitions</P> <P>...| rangemap field=Mem green=0-49 yellow=50-89 default=red|...</P> <P><A href="http://docs.splunk.com/Documentation/Splunk/7.0.1/SearchReference/Rangemap">http://docs.splunk.com/Documentation/Splunk/7.0.1/SearchReference/Rangemap</A></P> Mon, 22 Jan 2018 21:36:46 GMT https://community.splunk.com/t5/Dashboards-Visualizations/Hi-I-m-new-to-splunk-and-I-have-the-code-to-generate-a-dashboard/m-p/314169#M40029 nickhills 2018-01-22T21:36:46Z