hi I use the search below As you can see, I stat the events by SITE `CPU`
| fields process_cpu_used_percent host
| eval slottime = strftime(_time, "%H%M")
| where (slottime >= 900 AND slotti...
See more...
hi I use the search below As you can see, I stat the events by SITE `CPU`
| fields process_cpu_used_percent host
| eval slottime = strftime(_time, "%H%M")
| where (slottime >= 900 AND slottime <= 1700)
| lookup fo_all HOSTNAME as host output SITE
| search SITE=$tok_filtersite|s$
| eval cpu_range=case(process_cpu_used_percent>0 AND process_cpu_used_percent <=20,"0-20",
process_cpu_used_percent>20 AND process_cpu_used_percent <=40,"20-40",
process_cpu_used_percent>40 AND process_cpu_used_percent <=60,"40-60",
process_cpu_used_percent>60 AND process_cpu_used_percent <=80,"60-80",
process_cpu_used_percent>80 AND process_cpu_used_percent <=100,"80-100")
| stats avg(process_cpu_used_percent) as process_cpu_used_percent by host, _time, cpu_range SITE Now I need to do a timechart So I add this line | timechart span=1d dc(host) by cpu_range But I need to update my timechart by SITE because I use a dropdown list with differents SITE name As there is no SITE field in the timechart line, I lose this field so I am unable to display the timechart by SITE I have tried this but it doesnt works | timechart span=1d dc(host) by cpu_range SITE What I have to do for being able to filter the timechart by SITE? Thanks