This will do the trick: | mstats avg(cpu_metric.*) as cpu_* WHERE index=<your_metrics_index> by CPU, host | table CPU, host | eventstats max(CPU) as cpu_count by host | table cpu_count, host | eval cpu_count=cpu_count+   the data being used is from the add on Link to the splunk add on for Splunk Add-on for Unix and Linux docs  ... View more

I try to use this dashboard but get this error: Error on line 52: Unexpected close tag     after remote this line get another error:   Error on line -1: Rows can only contain visualization elements or panels, not both.   any idea? ... View more

this is the visualization of different hosts using the above query.   Hope this also gives you a better idea of what I'm achieving vs what I really wanna achieve. ... View more

@hishamjan  Splunk doesn't provide this functionality on its own; however, most of the solutions returned by a web search for e.g. "linux find largest files" can be implemented in Splunk as scripted inputs. ... View more

Start with your data - what fields do you have in vmstat? ... View more

Hi @hishamjan  You will need to add a field to your search query to include the selected host from your dropdown. For example, if the token from the dropdown was named "selected_host" then you would modify the search query for the panel to be: source="vmstat" host=$selected_host$ | dedup host | eval host=upper(host) | eval FreeGBs=FreeMBytes/1024, TotalGBs=TotalMBytes/1024, UsedGBs=UsedMBytes/1024 | table host memFreePct memUsedPct   And you will need to modify the dropdown to assign a value or an "*" (for no selected hosts) to the token "selected_host".  the Splunk documentation for Create and edit forms would be a great place to review those settings. One more thing to consider, if you want to view the data over time, then you will probably want to modify the search query for your panel to be populated by a timechart instead of eval/table.   source="vmstat" host=$selected_host$ | eval host=upper(host) | eval FreeGBs=FreeMBytes/1024, TotalGBs=TotalMBytes/1024, UsedGBs=UsedMBytes/1024 |timechart avg(memFreePct) as memFreePct, avg(memUsedPct) as memUsedPct by $selected_host$   Hope that helps. ... View more

Hi @hishamjan, the best approach is to install the Splunk App for Linux and Unix (https://splunkbase.splunk.com/app/273/) where you can find all the searches you need. Anyway, try this: index=os | multikv | stats max(pctCPU) as maxCPU values(Size) AS Size max(Used) AS used max(Avail) AS Avail BY host Filesystem | where maxCPU>80 Ciao. Giuseppe ... View more

Your monitor path is not correct. It should be [monitor:///var/log]. ... View more

"Is it possible to create a table of the largest files, smallest files, total files by each host or something close to that?" "I would want to know the largest file for every six hosts, their sizes as well as the name/path of that largest file." Thank you for changing the requirements.  I believe the existing answer has the information you need.  Just remove the parts you don't need. ... View more

@hishamjan RTP and SIP are application layer protocols that may use either TCP or UDP as a transport. I'm not familiar with Asterisk, but it presumably includes functionality to log session and call metrics. You can use Splunk App for Stream to monitor network traffic on the forwarders and send cooked traffic events to the indexer. Both RTP and SIP are supported. The implementation of Splunk App for Stream can be non-trivial. If you're unfamiliar with packet capture and protocol analysis concepts, you may prefer to enlist Splunk Professional Services or another qualified consultant. ... View more

Thanks a lot, I've got your point ... View more

You don't need the table _time totalCalls at the end, the extra field is in the table, just adjust the chart format ... View more

As you can see, the value you have in CAIB is "Current Active Inbound Calls:" which is why the rex does not find any numbers when you specify field CAIB, and why the rex without specifying the field (which will work on _raw) does find the values you are after. ... View more