Under Metrics, in the Splunk App for Unix, the query for CPU begins like this:
search (index=os sourcetype=cpu host=anyhost CPU="all")
If I remove CPU=all in the search, I see the data. How can I fix this?
search (index=os sourcetype=cpu host=anyhost CPU="all")
If I remove CPU=all in the search, I see the data.
Please try:
search (index=os sourcetype=cpu host=anyhost) | table CPU
OR
search (index=os sourcetype=cpu host=* CPU=*)