Specific query from Splunk SH to create a Dashboard

[splunk_luis12]

Hi all, 

I'm trying to find the specific queries for the SH to create Splunk dashboard of the following info (example)

USER PID %MEM %CPU

root     40          5.6         0.4

root       12         4.2         0.2

I got the index named  "stats"  sourcetype "top"

I need that dashboard to show the info from just the last 5 minutes.

Any idea?

Thanks,

Max

[ITWhisperer]

Can you provide some _raw events from your index in a code block </> so we can see what you are dealing with?

[ashvinpandey]

@splunk_luis12 Try the below queries:

index=stats sourcetype=top
| rename "%MEM" as Memory "%CPU" as CPU "USER PID" as user
| stats avg(Memory) as Memory avg(CPU) as CPU by user

Show as timechart:

index=stats sourcetype=top
| rename "%MEM" as Memory "%CPU" as CPU "USER PID" as user
| timechart avg(Memory) as Memory avg(CPU) as CPU by user

Showing single value:

index=stats sourcetype=top
| rename "%MEM" as Memory "%CPU" as CPU "USER PID" as user
| stats avg(Memory) as Memory

index=stats sourcetype=top
| rename "%MEM" as Memory "%CPU" as CPU "USER PID" as user
| stats avg(CPU) as CPU

There are many more options to be explored.

Also if this reply helped you in solving your problem an up-vote would be appreciated 👍