Under Metrics, in the Splunk App for Unix, the query for CPU begins like this: search (index=os sourcetype=cpu host=anyhost CPU="all") If I remove CPU=all in the search, I see the data. How can I fix this?
search (index=os sourcetype=cpu host=anyhost CPU="all") If I remove CPU=all in the search, I see the data.
Please try:
search (index=os sourcetype=cpu host=anyhost) | table CPU OR search (index=os sourcetype=cpu host=* CPU=*)
