First, you need to be regularly ingesting that data. connections is not CPU utilization, usually, but let's suppose it was. Then, you do this - Your search that gets just those events across time | stats avg(Value) as Value by host instance That gets you the average for each instance. Then you average again across instances | stats avg(Value) as Value by host However, depending on your monitoring software, there may also be another record there that contains the overall host information, regardless of instance. Check for that first. ... View more