So I have a search set up where I can find the cpu of a server for a given host. However, now I want to add an option in for ALL hosts where selecting this option would give me the total for all the hosts. At the moment I have filters to narrow down to 5 or so hosts where I can then pick one to choose from. Now I want an option on an input dropdown menu, where if selected would add all of these hosts together. How do I edit my search statement to do this? At the moment it is currently:
|inputlookup input.csv.gz | search name = $application$ | stats values(hostName) AS hostname | mvexpand hostname
which gets the chosen host and the following generates the dashboard
index=index sourcetype="courscetype" $hostname$ date_year = $yearr$ date_month = $monthh$ | dedup _raw | eval A = substr(tostring(date_wday),1,1) | eval B = substr(date_wday,2) | eval A = upper(A) | eval dte = A + B | eval newDate = tostring(date_mday + \" \" + dte) | chart limit=0 max(AvgCpuPerc) over newDate by date_hour | table newDate 0 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 | rename newDate as "Date/Time"
... View more