I appreciate your reply & might be asking too much. I have used the following in the past in my new environment it returns an error, "in the search expression you must provide a macro expression" that I can not fix, I did try ! When free please advise & Thx again index=_introspection earliest=-30d component=Hostwide [|inputlookup dmc_assets | table serverName as host, search_group | search search_group=*dmc_group_index* OR search_group=*dmc_group_search_head* | table host ] | eval cpu_util = ('data.cpu_user_pct' + 'data.cpu_system_pct') | bin _time span=5m | table _time host data.cpu_count data.virtual_cpu_count data.cpu_idle_pct data.cpu_idle_pct cpu_util ```5-min Roll-Up``` | stats max(data.cpu_count) AS physical_cores, max(data.virtual_cpu_count) AS numberOfVirtualCores, max(cpu_util) as CPU_util_pct_max by _time host | eval max_5minCPUsUsed = CPU_util_pct_max*numberOfVirtualCores/100 | stats values(host) as host_list dc(host) as total_hosts sum(physical_cores) as physical_cores sum(numberOfVirtualCores) as numberOfVirtualCores sum(max_5minCPUsUsed) as max_5minCPUsUsed by _time ```24h Roll-Up``` | bin _time span=1d | stats values(host_list) as host_list max(total_hosts) as total_hosts max(physical_cores) as physical_cores max(numberOfVirtualCores) as numberOfVirtualCores p90(max_5minCPUsUsed) as p90Daily_5minMax_CPUsUsed by _time ```Month Roll-Up``` | appendpipe [ | stats max(total_hosts) as total_hosts, max(physical_cores) as physical_cores, max(numberOfVirtualCores) as numberOfVirtualCores, p90(p90Daily_5minMax_CPUsUsed) as p90Daily_5minMax_CPUsUsed | eval _time="90th Perc. across report duration (equivalent to 3 days out of 30)"]
... View more