What is the difference between PercentIdleTime and pctIdle when looking at CPU (index=os)?
I have looked up for answers and this is the closest but does not explain the difference:
index=os sourcetype=cpu host=* | multikv fields PercentIdleTime | eval Percent_CPU_Usage = 100 - pctIdle | where Percent_CPU_Usage > 75
Both are same. They just created field aliases for pctIdle AS PercentIdleTime.