I was able to easily get this working on Linux to read nmon logs generated from cron. However, it is not working on AIX. I do see the splunkd.log where it appears to be reading the .nmon files once they stop being written to. Nothing every gets to the indexers, and the fishbucket seek pointer for the .nmon file remains at 0. ... View more

I have a timechart that shows me the daily throughput for a log source per indexer. I'm trying to find a way to add the average at the bottom for each column of the chart to show me the daily average per indexer. There is a command called "addcoltotal", but I'm looking for the average. index=_internal source="*metrics.log" group=per_source_thruput series=network earliest=-30d | eval dailyGB=(kb/1024000) | timechart span=1d sum(dailyGB) by host _time indexer1 index2 indexer3 1 3/7/12 12:00:00.000 AM 7.86325036907982 8.8324329432009 3.432423543254 2 3/8/12 12:00:00.000 AM 55.2752835159227 0.1303261899898 2.134345324324 3 3/9/12 12:00:00.000 AM 53.2091017865928 4.8808330507275 5.6209532661776 4 3/10/12 12:00:00.000 AM 17.6108422803661 5.2928352422775 3.5238746919151 Average: # # # ... View more