I have four hosts. H1, H2, H3, H4
each host have cpu_load
I want to find min cpu_load and max cpu_load. Find the min/max out of all host. In My scenario out of 4 host, find the min/max.
| stats min(host of cpu_load) as Min, max(host of cpu_load) | eval diff=max-min | alert based on diff
Any help is appreciated. Thank you
I changed the question a bit.
... | stats count by host
The count of each host is different. How would you eval min_value and max_value of these host counts?
| stats max(cpu_load) as max_tmp min(cpu_load) as min_tmp by host
| eventstats max(max_tmp) as max_final min(min_tmp) as min_final
| eval max_flag=if(max_tmp=max_final,1,0) , min_flag=if(min_tmp=min_final,1,0)
| where min_flag=1 OR max_flag=1
mmm.. It didn't do it. Let me ask the question in different way. Lets forget about CPU. Lets say each host is giving you count of sessions or count of traffic.
index=app | stats count by host
result based on 4 host
How would you find max count out of 4 host