Introducing SOC Insights for BloxOne Threat Defense: Boost your SOC efficiency with AI-driven insights to eliminate manual work and accelerate investigation and response times. Read the blog announcement here.

Reporting

Reply

CPU Utilization Trend / Memory Utilization Trend filtered by extensible attributes

New Member
Posts: 1
594     0

Hi all,
I'm trying to modify some reports filtering results by extensible attributes or specific grid member.
Example of " CPU Utilization Trend (Detailed)":

sourcetype=ib:system index=ib_system " 1 " | bucket span=1m _time | timechart bins=1000 avg(CPU_PERCENT) by host where max in top5 useother=f | interpolate 120

Now the report shows only top5 but I would like to see only all the GRID member with "site=EMEA" (foe example)  as extensible attribut.
Also, I would like to understand how to see same results for a specific member or multiple name member.

 

I tried to change it myself also with doumentation but I was not able to find teh solution, have someone of you already changed search for members matching extensible attributes?

 

Thank you,

Fabio

Showing results for 
Search instead for 
Did you mean: 

Recommended for You