How to Graph CPU usage of indexers over time?

[DEADBEEF]

I received this image from support and I would like to create a panel in my dashboard to mimic this information.  How would I go about doing that?  I was trying with the current query, but am not having luck.

index=_introspection data.normalized_pct_cpu=* sourcetype=splunk_resource_usage host=idx*
| stats avg(data.normalized_pct_cpu) AS cpu_usage BY host
| table host cpu_usage

I am using data.normalized_pct_cpu as the docs state that it is Percentage of CPU usage across all cores. 100% is equivalent to all CPU resources on the machine, which seems to be what I want but not sure if that is the best way to go about this.

[ITWhisperer · Accepted solution]

Given that you graphic has a time component, perhaps this might work better for you

index=_introspection data.normalized_pct_cpu=* sourcetype=splunk_resource_usage host=idx*
| timechart avg(data.normalized_pct_cpu) AS cpu_usage BY host