hi
I use the search below in order to display a timechart which count the number of host which are in a cpu range consumption (0 - 20, 20 -40, 40 - 60)
`CPU` earliest=-30d latest=now
| fields process_cpu_used_percent host
| eval cpu_range=case(process_cpu_used_percent>0 AND process_cpu_used_percent <=20,"0-20",
process_cpu_used_percent>20 AND process_cpu_used_percent <=40,"20-40",
process_cpu_used_percent>40 AND process_cpu_used_percent <=60,"40-60")
| timechart span=1d dc(host) as host by cpu_range
I need to changes :
1) Instead counting the number of process_cpu_used_percent by host in a cpu range, I need to count the number of the process_used_percent **average** by host in a cpu range
2) Is is possible to take only the evnts which are in a specific slot time? (between 8h and 17h)
thanks a lot for your help
↧