Try this
| bin _time span=1m
| stats avg(value) as avg by _time host cpu
| eval {cpu}=avg
| fields - avg cpu
It depends on what you are trying to show!
You could use a trellis format, one tile for each host, or you could concatenate the host and cpu into a single field and display them all on one chart.
For trellis, you need to keep host and cpu separate - try something like this
| bin _time span=1m
| stats avg(value) as avg by _time host CPU
If you want them all on the same chart, then you concatenate host and cpu
@ITWhisperer I think it will be better to have separate graph for each host.
I tried what you suggested but it doesn't seems like working. Infact its not changing any thing in results. Am I missing something ?
basically in one chart it should show all CPU graph for single host.
Try this
| bin _time span=1m
| stats avg(value) as avg by _time host cpu
| eval {cpu}=avg
| fields - avg cpu