All Apps and Add-ons
Highlighted

How do I specify more than one host in the Percent_CPU_by_Host function?

New Member

I am utilizing the built-in search function "PercentCPUby_Host(*)" but I would like to only display 2 host and the following search string is not working:

Percent_CPU_by_Host( Host_A OR Host_B)

How do I specify more than one hosts?

0 Karma
Highlighted

Re: How do I specify more than one host in the Percent_CPU_by_Host function?

Motivator

can you be more specific? what is the PercentCPUby_Host function?

0 Karma
Highlighted

Re: How do I specify more than one host in the Percent_CPU_by_Host function?

Esteemed Legend

It is part of the Splunk App for Unix and Linux (I have retagged).

0 Karma
Highlighted

Re: How do I specify more than one host in the Percent_CPU_by_Host function?

Esteemed Legend
0 Karma
Highlighted

Re: How do I specify more than one host in the Percent_CPU_by_Host function?

Explorer

I did it by like below.
Percent_CPU_by_Host("Host_A OR host=HOST_B")

This macro define like below.

args = host
definition = `os_index` `cpu_sourcetype` host=$host$ | eval Percent_CPU_Load = 100 - pctIdle | timechart avg(Percent_CPU_Load) by host
0 Karma