I'd like to run search to look at average and max values for every server over an extended period of time. Currently I'm doing
index=os sourcetype="sourcetype" source="source"|stats avg(Value) max(Value) by host
But this is taking an extremely long time to run. Is there a way to make this search more efficient?
Are you running a separate search for each process? If so, you could build a simple if statement to specify the value like this
| eval CPU=if(counter="% Processor Time",'Value',"N/A")
| eval Disk=if(counter="% Free Space",'Value',"N/A")
If not then you may want to look into accelerated data models. This will run substantially faster than over the raw data