Hi all,
I'm having difficulty trying to create a total_cpu field. If I map a single variable to it, this works fine and creates the field, but if I try to add them together, no field is returned.
Current query below:
sourcetype="Perfmon:Processor" host="CFDFXNFR-APP22" instance=_Total AND (counter="% User Time" OR counter="% Privileged Time" OR counter="% Interrupt Time") |
eval user=if(counter="% User Time", Value, null()) |
eval system=if(counter="% Privileged Time", Value, null()) |
eval interrupt=if(counter="% Interrupt Time", Value, null()) |
eval total_cpu=user+system+interrupt |
timechart per_second(user) as user, per_second(system) as system, per_second(idle) as idle, per_second(interrupt) as interrupt, per_second(total_cpu) as total_cpu by host limit=100 span=1s
Does anyone have any insight into what may be going wrong here?
Many thanks in advance!!
... View more