Hi @splunkreal , why not? I installed this app in a Search Head Cluster without issues. Ciao. Giuseppe ... View more

I assume that there is a typos in your MaxPeakTPS in the eventstats command and your use of peakTPS in the following stats and also the use of peakTime, which does not exist as a field. You can do this | timechart span=1s count AS TPS ``` Calculate min and max TPS ``` | eventstats max(TPS) as max_TPS min(TPS) as min_TPS ``` Now work out average TPS, actual min and max TPS and then the first occurrence of the min/max TPS ``` | stats avg(TPS) as avgTPS values(*_TPS) as *_TPS min(eval(if(TPS=max_TPS, _time, null()))) as maxTime min(eval(if(TPS=min_TPS, _time, null()))) as minTime | fieldformat maxTime=strftime(maxTime,"%x %X") | fieldformat minTime=strftime(minTime,"%x %X") The min(eval... statements just look for the first _time when TPS is either min or max to get the earliest time when these occurred. Note the use of field naming conventions min_TPS/max_TPS that allows the use of wildcards in the stats.   ... View more

Yep! Le't stay as said... if someone else wants to add something, you're welcome, tcp_Kprocessed == Kb received by the receiver as a packet of events kb == the real Kb (compressed) written on Indexer storage Explicit and simple, tcp_Kprocessed == the Networking thruput of events packet kb == the Compressed Data written to Indexer Storage of previous packet 👍 ... View more