There is no such thing as CIM-compliance for indexes.  CIM compliance applies to field names (and some values). To make ES aware of your index names, install your "all_indexes" app on the ES search head. ... View more

Once you've created the chart, click on the Format icon then switch to the X-Axis tab where you specify the label rotation.  Or you can do so in Simple XML <option name="charting.axisLabelsX.majorLabelStyle.rotation">-90</option> You may be able to change the time format using the fieldformat command. index=unix (source=cpu sourcetype=cpu) OR (sourcetype=vmstat) host IN (usaws135000) | fields _time cpu_load_percent memUsedPct swapUsedPct host | timechart span=1h eval(round(avg(cpu_load_percent),2)) as CPUAvg eval(round(avg(memUsedPct),2)) as MemoryAvg eval(round(avg(swapUsedPct),2)) as SwapAvg by host useother=t limit=0 | fieldformat _time=strftime(_time, "%m/%d/%Y %H:%M:%S") I'm not sure if it's possible to display as many labels as in your example, but this might do it. <option name="charting.axisLabelsX.majorLabelVisibility">show</option> The default of "auto" selectively hides labels to improve readability. See https://docs.splunk.com/Documentation/Splunk/9.0.4/Viz/ChartConfigurationReference#Area.2C_Bubble.2C_Bar.2C_Column.2C_Line.2C_and_Scatter_charts for more   ... View more

The Monitoring Console should answer most if not all of your questions.  Go to Resource Usage->CPU Usage:Instance then scroll down to the "Median CPU Usage of Searches" panel.  Split the data by search type or user to see what the heavy hitters are. ... View more

I'm not familiar with the sim_licensing_* macros so can't give very specific advise.  However, if there is a "sim_licensing_summary_no_split" macro then I have to think there is one similar to "sim_licensing_summary_by_index". If not, then expand the macros (using CTRL-Shift-E) and modify the stats command to group results by index. ... View more

The max_match option is relevant because its absence tells me we're not dealing with a mutli-value field and so the mvexpand command is not of use. To get each component of the values field into its own field we need to parse it.  There is the extract command, but it only works with _raw so we have to jump through some hoops to use it. <<your search to extract the values field>> | eval _raw = values | extract pairdelim=, kvdelim== | table values count max min avg col gantry energy   ... View more