Are you looking for something like this? If not, please add a comment with more details about what you want.
index=_introspection host=* data.cpu_system_pct=* | timechart span=1d avg(data.cpu_system_pct) by host
another way that is faster, but has a different visualization
| tstats max(data.cpu_system_pct) as AvgCPUPct where index=_introspection by host
... View more
The documentation for the resource-usage call makes me think only the current usage is returned. Looking at the output seems to confirm that as there is no timestamp field in the data. I think the expectation is you will create a scheduled search that invokes resource-usage at intervals and saves the results in a summary index for later report generation.
There is another way. Try this search to get historical memory use (as a percentage).
index=_introspection component=PerProcess | rename data.process as process, data.pct_memory as mem_used | `dmc_classify_processes` | timechart max(mem_used) by process
... View more