Trying build a time chart for Top 10 CPU consuming Processes for a Linux host for a given timeframe.
index=os host=xxxxxx source=top pctCPU != 0.0
| table COMMAND, pctCPU _time | sort - pctCPU | dedup COMMAND | head 10
I am trying to get a timechart based for the pctCPU usage only for these 10 COMMANDS.
Thanks
You could try something like this
index=os host=xxxxxx source=top pctCPU != 0.0
| fields COMMAND, pctCPU _time
| eventstats max(pctCPU) as maxpctCPU by COMMAND
| sort - maxpctCPU COMMAND
| streamstats dc(COMMAND) as rank
| where rank <= 10
| fields - rank maxpctCPU
| timechart span=1h max(pctCPU) as maxpctCPU by COMMAND
You could try something like this
index=os host=xxxxxx source=top pctCPU != 0.0
| fields COMMAND, pctCPU _time
| eventstats max(pctCPU) as maxpctCPU by COMMAND
| sort - maxpctCPU COMMAND
| streamstats dc(COMMAND) as rank
| where rank <= 10
| fields - rank maxpctCPU
| timechart span=1h max(pctCPU) as maxpctCPU by COMMAND