better:
| rest splunk_server_group=dmc_group_indexer splunk_server_group="dmc_group_indexer" /services/server/introspection/queues
| search title=parsingQueue* OR title=aggQueue* OR title=typingQueue* OR title=indexQueue*
| eval fill_perc=round(current_size_bytes / max_size_bytes * 100,2)
| fields splunk_server, title, fill_perc
| rex field=title "(?<queue_name>^\w+)(?:\.(?<pipeline_number>\d+))?"
| eval fill_perc = if(isnotnull(pipeline_number), "pset".pipeline_number.": ".fill_perc, fill_perc)
| chart values(fill_perc) over splunk_server by queue_name
| eval pset_count = mvcount(parsingQueue)
| join type=outer splunk_server [
| rest splunk_server_group=dmc_group_indexer splunk_server_group="dmc_group_indexer" /services/server/introspection/indexer
| eval average_KBps = round(average_KBps, 0)
| eval status = if((reason == ".") OR (reason == "") OR isnull(reason), status, status.": ".reason)
| fields splunk_server, average_KBps, status]
| fields splunk_server pset_count average_KBps status parsingQueue aggQueue typingQueue indexQueue
| sort -average_KBps
| stats sum(average_KBps) AS "average_KBps"
| eval "average_MBs"=round(average_KBps/1024, 2)
... View more