I am utilizing the built-in search function "Percent_CPU_by_Host(*)" but I would like to only display 2 host and the following search string is not working:
Percent_CPU_by_Host( Host_A OR Host_B)
How do I specify more than one hosts?
I did it by like below.
Percent_CPU_by_Host("Host_A OR host=HOST_B")
This macro define like below.
args = host
definition = `os_index` `cpu_sourcetype` host=$host$ | eval Percent_CPU_Load = 100 - pctIdle | timechart avg(Percent_CPU_Load) by host
Anyone who answers this question should answer this one, too:
https://answers.splunk.com/answers/231538/splunk-app-for-unix-and-linux-how-to-combine-multi.html
can you be more specific? what is the Percent_CPU_by_Host function?
It is part of the Splunk App for Unix and Linux (I have retagged).