Hi Splunkies,
this is my search:
index="vmware-perf" sourcetype="vmware:perf:cpu" hypervisor_id="*"
| join hypervisor_id [search index="vmware-inv" sourcetype="vmware:inv:hostsystem"]
| timechart avg(cpu_load_percent) by hypervisor_name
my Problem:
This search will list all hosts.
But, i would like to have an evaluation of the top 5 hosts.
The idea was to calculate the sum of average values from one host over a period of time.
Then i compare this result with the other hosts and could sort a top 5 list...
Does anyone have an idea how to modify the search?
↧