Thanks,   But this query seems to be specefic to fix inputs.....while all this values are subjecteedd to change dynamically.     What i want to calculate average % usage of field "system CPU". I HAVE  other fields extracted like : index type,host,sourcetype.   so i can create dasboards for cpu usage by  index type,host,sourcetype.   Note: we dont have extracted field for cpu percentage (CPU_perc) ... View more

XXXXXXXXXXXXXXXXXXXXX gsystem.cpp:XXX] System_GSystem|GSystemWatcher|Idle|involuntary context switches|0|user time|0.48%|system time|0.45%|system CPU|7.14687%|iowait|0.0224% XXXXXXXXXXXXXXXXXXXXX gsystem.cpp:XXX] System_GSystem|GSystemWatcher|Health|ProcMaxGB|0|ProcAlertGB|0|CurrentGB|16|SysMinFreePct|10|SysAlertFreePct|30|FreePct|77 XXXXXXXXXXXXXXXXXXXXX gsystem.cpp:XXX] System_GSystem|GSystemWatcher|Idle|involuntary context switches|0|user time|0.46%|system time|0.44%|system CPU|7.11321%|iowait|0.056% XXXXXXXXXXXXXXXXXXXXX gsystem.cpp:XXX] System_GSystem|GSystemWatcher|Health|ProcMaxGB|0|ProcAlertGB|0|CurrentGB|16|SysMinFreePct|10|SysAlertFreePct|30|FreePct|77 XXXXXXXXXXXXXXXXXXXXX gsystem.cpp:XXX] System_GSystem|GSystemWatcher|Idle|involuntary context switches|0|user time|0.61%|system time|0.46%|system CPU|8.64004%|iowait|0.0448% XXXXXXXXXXXXXXXXXXXXX"60 gsystem.cpp:XXX] System_GSystem|GSystemWatcher|Health|ProcMaxGB|0|ProcAlertGB|0|CurrentGB|16|SysMinFreePct|10|SysAlertFreePct|30|FreePct|77 ... View more

cant share more details as its client server.   but there is no field extracted for CPU ... View more

i tried these query ..but not seeing any output in CPU_perc field. ... View more