@tgdvopab,
I'm adding in @renjith.nair's search. Can you please try this search??
index=performance_monitoring sourcetype="perf:cpu"
| timechart limit=0 useother=false span=30min avg(cpu_user_percent) as avg_cpu_user_percent, avg(cpu_system_percent) as avg_cpu_system_percent by hostname
| untable _time,hostname,cpu_core
| eval column="",host=""
| foreach hostname
[ eval column=mvindex(split('<<FIELD>>',":"),0),host=mvindex(split('<<FIELD>>',":"),1) ]
| eval {column}=cpu_core
| fields - cpu_core,hostname,column
| stats values(*) as * by _time host
My Sample Search: I've used internal index to perform this like operations.
index="_internal" component=* group=per_*
| timechart avg(kbps) as avg_cpu_user_percent, avg(kb) as avg_cpu_system_percent by group
| untable _time,hostname,cpu_core
| eval column="",host=""
| foreach hostname
[ eval column=mvindex(split('<<FIELD>>',":"),0),host=mvindex(split('<<FIELD>>',":"),1) ]
| eval {column}=cpu_core | fields - cpu_core,hostname,column | stats values(*) as * by _time host
Thanks
... View more