So, I use this query:
index=perfmon object=Processor host=* counter="% Processor Time" | stats avg(Value) as 15minavg by host | sort 5 - 15minavg
to produce a dashboard panel like this:
host 15minavg
server08 82.822502
server11 56.993420
server04 56.809193
server19 52.914549
server12 52.114838
Now, I would like to rework that panel to be a horizon visualization of timechart span=1m avg(Value) by host
for only those servers.
It's Friday afternoon and I've spent the last 3 hours trying top, where, append, join and I'm no further ahead than when I began.
Any suggestions?
What about using a subsearch like this:
index=perfmon object=Processor counter="% Processor Time" earliest=-15m [
| search index=perfmon object=Processor host=* counter="% Processor Time" earliest=-15m
| stats avg(Value) as 15minavg by host
| sort 5 - 15minavg
| table host
] | timechart span=1m avg(Value) by host
Try this
index=perfmon object=Processor host=* counter="% Processor Time" [search index=perfmon object=Processor host=* counter="% Processor Time" | stats avg(Value) as 15minavg by host | sort 5 - 15minavg | table host ] | timechart span=1m avg(Value) by host
What about using a subsearch like this:
index=perfmon object=Processor counter="% Processor Time" earliest=-15m [
| search index=perfmon object=Processor host=* counter="% Processor Time" earliest=-15m
| stats avg(Value) as 15minavg by host
| sort 5 - 15minavg
| table host
] | timechart span=1m avg(Value) by host