How to convert  `_time` to the column and  `host` as an index while using `mstats`? | mstats avg(_value) prestats=true WHERE metric_name="cpu.*" AND index="*" AND (host="host01.example.com" OR host="host02.example.com" OR host="host03.example.com" OR host="host04.example.com" OR host="host05.example.com" OR host="host06.example.com" ) AND `sai_metrics_indexes` span=auto BY metric_name | timechart avg(_value) as "Avg" span=30m by metric_name | fillnull value=0 | foreach *[| eval "<<FIELD>>"=round('<<FIELD>>',2)]  The above results in as follows: What is Desired: host _time cpu.idle cpu.interrupt cpu.nice cpu.softirq cpu.steal cpu.system cpu.user cpu.wait host01.example.com 2022-03-31 07:30:00 57.56 0.00 22.98 0.08 0.00 18.75 0.59 0.04 host01.example.com 2022-03-31 08:00:00 59.08 0.00 22.02 0.11 0.00 18.06 0.70 0.04 host01.example.com 2022-03-31 08:00:00 61.79 0.00 20.53 0.08 0.00 16.96 0.62 0.04 Any help will be uch appeciated. ... View more

I am looking forward to creating a table for system metrics values like "cpu", "memory" and "swap", now if run the below search it works, but it will get all hosts available while I want my search to be specific to some hosts. 1) | mstats max(cpu.idle) AS "CPU_IDLE" avg(memory.free) as "MEMORY_FREE" avg(swap.used) as "SWAP_USED" WHERE `sai_metrics_indexes` earliest=-30m@m by host | eval "cpu_active"=100-cpu_idle | fillnull value=0 | foreach CPU* MEM* SWAP* [| eval "<<FIELD>>"=round('<<FIELD>>',2)] 2)Where if i try like below then i get an error as i am beginner and not getting the right approach to get it . | mstats max(cpu.idle) AS "CPU_IDLE" avg(memory.free) as "MEMORY_FREE" avg(swap.used) as "SWAP_USED" WHERE `sai_metrics_indexes` earliest=-30m@m by ("host"="host1.example.com" OR "host"="host2.example.com" OR "host"="host3.example.com" ) | eval "cpu_active"=100-cpu_idle | fillnull value=0 | foreach CPU* MEM* SWAP* [| eval "<<FIELD>>"=round('<<FIELD>>',2)] 1) working screen shot  2)  trial but not working  Would appreciate to get any help or direction on this. ... View more

Hello experts, How to round up the values either before decimal point or up to max two decimal point. Below is my search query: | mstats avg(_value) prestats=true WHERE metric_name="memory.used" AND "index"="*" AND ( "host"="fsx2098" OR "host"="fsx2099" OR "host"="fsx0102" OR "host"="fsx0319" OR "host"="fsxtp072" ) AND `sai_metrics_indexes` span=auto BY host | timechart avg(_value) useother=false BY host WHERE max in top20 | fields - _span* Below is Result of above: Desired Value: time                                                 host 1              host2              host3                host4 2022-03-29 13:20:00             26                       33                     34                     32 2022-03-29 13:21:00             27                       34                    34                    34 OR time                                                 host 1              host2              host3                host4 2022-03-29 13:20:00             26.80                33.96             34.25                 32.93 Any help will be much appreciated.   ... View more

Hello experts, I Just want my field `snow_os_version`  to be up to 2 decimal points like the first entry should only be  `3.10`, How to achieve that.   ... View more