Hi Picklerick,  So the Forti app has a n event dashboard to view the CPU and Memory: But when you open the search you get no results: |tstats summariesonly=true last(log.system_event.system.cpu) AS cpus FROM datamodel=ftnt_fos WHERE nodename="log.system_event.system" log.devname="*" log.vendor_action=perf-stats groupby _time log.devname | timechart values(cpus) by log.devname   New to Splunk so just wondering if there is something here i need to mod...   cheers   ... View more