index=105261-cli sourcetype=show_processes_cpu pid=0
| dedup deviceId
| fields deviceId, idle, fiveMinutes
| eval cpuLoad = round(if(isnull(fiveMinutes), 100-idle, fiveMinutes))
| join deviceId
[ search index=105261-np sourcetype=device_details
| fields deviceId, deviceName, productFamily, swVersion ]
| eval Status=if((cpuLoad <85 ), "OK" , "Not OK" )
| table deviceName, productFamily, cpuLoad, swVersion, Status
| sort - cpuLoad
This query might do the trick. I believe your dedup will in practice get the most recent event from the cli index for that device, hence the use of latest(*)
(index=105261-cli sourcetype=show_processes_cpu pid=0) OR (index=105261-np sourcetype=device_details)
| fields deviceId, idle, fiveMinutes deviceId, deviceName, productFamily, swVersion
| stats latest(*) as * by deviceId
| eval cpuLoad = round(if(isnull(fiveMinutes), 100-idle, fiveMinutes))
| eval Status=if((cpuLoad <85 ), "OK" , "Not OK" )
| table deviceName, productFamily, cpuLoad, swVersion, Status
| sort - cpuLoad
but this
Hope this helps.