Process usage by host

[jackpal]

We are tracking Linux process usage across several hosts which are tagged. I can get an overall usage by process across all hosts combined but I'd like to separate this out by host for alerting purposes.

My query so far:
index=os OR index=main sourcetype=ps tag=dcv COMMAND="gnome-shell" | stats sum(pctCPU) as pctCPU by _time,COMMAND | timechart avg(pctCPU) by COMMAND

[richgalloway]

If COMMAND is fixed, there's no need for it in the by clause. Try this query.

index=os OR index=main sourcetype=ps tag=dcv COMMAND="gnome-shell" | stats sum(pctCPU) as pctCPU by _time,host | timechart avg(pctCPU) by host