Introducing SOC Insights for BloxOne Threat Defense: Boost your SOC efficiency with AI-driven insights to eliminate manual work and accelerate investigation and response times. Read the blog announcement here.



CPU Utilization Trend / Memory Utilization Trend filtered by extensible attributes

New Member
Posts: 1
496     0

Hi all,
I'm trying to modify some reports filtering results by extensible attributes or specific grid member.
Example of " CPU Utilization Trend (Detailed)":

sourcetype=ib:system index=ib_system " 1 " | bucket span=1m _time | timechart bins=1000 avg(CPU_PERCENT) by host where max in top5 useother=f | interpolate 120

Now the report shows only top5 but I would like to see only all the GRID member with "site=EMEA" (foe example)  as extensible attribut.
Also, I would like to understand how to see same results for a specific member or multiple name member.


I tried to change it myself also with doumentation but I was not able to find teh solution, have someone of you already changed search for members matching extensible attributes?


Thank you,


Showing results for 
Search instead for 
Did you mean: 

Recommended for You