Hola @patouellet ! My apologise for the late reply (I was very busy in TrackMe!), and thanks @dsou for your great help 😉 So, to answer the question, this is mostly an historical reason, in the NMON Summary Light dashboard the search is designed to be OS type agnostic, in short the smt threads is an AIX only concept which requires some obscur additional calculation to get closer to an accurate measurement of the processes (PIDs) costs. Technically for Linux, that isn't required, the Nmon Analyser view for Linux does not have to deal with this and thus the query is simplier and more effiscient. There's an additional field in the mstats level by statement too which can matter at some points as it creates more in memory records and I assume certainly has some compute costs too. (this one could actually be removed) Last but not least, the SPL queries were designed for the initial implementation of mstats, there has been updates since and these queries could potentially be even faster, for instance the search could be: | mstats sum(os.unix.nmon.processes.top.pct_CPU) as pct_CPU where `nmon_metrics_index` host=myhost by dimension_Command span=1m
| eval usage_per_core=(pct_CPU/100)
| timechart `nmon_span` useother=f limit="50" max(usage_per_core) as "CPU Usage per core" by dimension_Command For compability purposes with old versions of Splunk, the app was not updated, however with the deprecation of 7.0, it certainly would be interesting to review and update these queries. Building this app and the Nmon legacy has a been a work of many years with complex dashboards and many UIs, so this wouldn't happen in a day but defitively in my todo list. Let me know if you have any further questions. Guilhem
... View more