Hello, I am looking for my search results for only 6pm to 9pm over the last 90 days. How can I achieve this with the below query?
index=* host=* | eval pctCPU=if(CPU="all",100-pctIdle,Value) | timechart avg(pctCPU) AS avgCPU BY host
Try filtering the results on the date_hour field.
index=* host=* | where date_hour>=18 AND date_hour<21 | eval pctCPU=if(CPU="all",100-pctIdle,Value) | timechart avg(pctCPU) AS avgCPU BY host
