Thank you! This works perfectly apart from some naming issues with the lasts lines, the final solution is:
index=os host=* (source=cpu NOT cpu="all") OR source=vmstat OR source=df OR sourcetype=df
| `convert_memk(Avail, nodeDiskCapacityByte) `
| eval Filesystem = if(isnull(Filesystem),"N/A", Filesystem)
| stats max(cpu) as cpu, max(memTotalMB) as memTotalMB, first(nodeDiskCapacityByte) as nodeDiskCapacityByte by Filesystem, host
| stats max(cpu) as cpus, max(memTotalMB) as memoryMB, count(eval(Filesystem!="N/A")) as drives, sum(nodeDiskCapacityByte) as nodeDiskCapacityByte by host
| eval cpus=if(isnum(cpus), tostring(cpus+1)." cores", "N/A")
| eval memoryGB=tostring(round((memoryMB/1000), 0))." GB"
| eval drives=if(drives=0, "N/A", tostring(drives)." drives")
| eval nodeDiskCapacityGB=round((nodeDiskCapacityByte/1000000), 0)." GB"
| fields host, cpus, memoryGB, drives, nodeDiskCapacityGB
| rename host as Node
| rename cpus as "Available CPU cores"
| rename memoryGB as "Available memory"
| rename drives as "Number of drives"
| rename nodeDiskCapacityGB as "Total node disk space"
This was also applicable on another problem I had, so thanks once again.
... View more