I would like to generate a plot of cpu utilization over time. I have some permon events coming in that look like 02/11/2014 09:21:04.315 collection=CPU object=Processor counter="% Processor Time" instance=_Total Value=0.0084302548057690885 and so I can easily enough write the following search source="perfmon:cpu" | timechart span=15m avg(Value) as CPU The problem I perceive is that I think permon:cpu is an instantaneous value. If so then the rate at which the agent reports sends updates (or events) sets a minimum detectable load. Basically I'm saying that if I am only getting a cpu event every 5 min, then chances are I would never see a 30sec spike in cpu utilization. I could just up the cpu event rate to someting like 10 sec (to detect 30 sec spikes), but I am wondering if there is another approach that will not involve increasing the number of cpu events dramatically? ... View more

I have events with a field that contains a desired destination index (see index=* below). [timestamp] index=layer1 message="123456" [timestamp] index=layer2 message="123456" [timestamp] index=layer3 message="123456" [timestamp] index=jumbled message="123456" [timestamp] index=layer1 message="123456" [timestamp] index=layer1 message="123456" [timestamp] index=layer2 message="123456" I'm currently using a transform like the following, and it works quite well to get events into their correct index. [MyTransform] REGEX = .*index="(.*?)" DEST_KEY = _MetaData:Index FORMAT = $1 At least most of the time. Occasionally an event arrives whose index field names an index which doesn't exist (either because the name is wrong or I forgot to create the index). In this case the above transform appears to simply generate an error in the internal index and otherwise drop the data. Is there another way to do this that would drop messages which failed match an existing index into some catch all index of my choosing? Something like FORMAT if ($1).exists $1 else myDefaultCatchAllIndex ... View more