<form script="togglepanel.js" stylesheet="ui_simple.css,panel_decoration.css" isVisible="false" version="1.1" theme="dark">
    <label>Drilldown TOP processes consumers</label>
    <description></description>

    <!-- Base Searches for PostProcessing -->

    <search id="populate">
        <query>| mcatalog values(metric_name) where `nmon_metrics_index` metric_name="os.unix.nmon.processes.top.*" by host
| `mapping_frameID`
| stats count by frameID, host | sort 0 host</query>
        <earliest>$timerange.earliest$</earliest>
        <latest>$timerange.latest$</latest>
    </search>

    <search id="populate_command">
        <query>| mcatalog values(dimension_Command) as commands where `nmon_metrics_index` metric_name="os.unix.nmon.processes.top.*" host=$host-prefilter$ $host_query$ (dimension_Command=$Command$) (dimension_PID=$PID$) by host
| rename commands as dimension_Command
| stats count by dimension_Command</query>
        <earliest>$timerange.earliest$</earliest>
        <latest>$timerange.latest$</latest>
    </search>

    <!--
    Dynamic configuration
    The following searches are being used to define various tokens using event handlers
    -->

    <row>
        <panel id="selection_togglepanel_true">

        <title>Selection filtering</title>

            <input type="time" token="timerange" searchWhenChanged="true">
                <label>Time Range:</label>
                <default>
                    <earliest>-24h</earliest>
                    <latest>now</latest>
                </default>
                <change>
                    <unset token="form.refresh"></unset>
                </change>
            </input>

            <input type="dropdown" token="timefilter" searchWhenChanged="true">
                <label>Time Filtering:</label>
                <choice value="No_Filter">No Filter (24/24, 7/7)</choice>
                <choice value="Day_BusinessDays_8h-19h">Day Business (08h-19h)</choice>
                <choice value="Day_WeekEnd_8h-19h">Day WE (08h-19h)</choice>
                <choice value="Day_AllDays_8h-19h">Day Week (08h-19h)</choice>
                <choice value="Night_BusinessDays_19h-8h">Night Business (19h-08h)</choice>
                <choice value="Night_WeekEnd_19h-8h">Night WE (19h-08h)</choice>
                <choice value="Night_AllDays_19h-8h">Night All Days (19h-08h)</choice>
                <default>No_Filter</default>
            </input>

            <input id="frameID" type="multiselect" token="frameID" searchWhenChanged="true">
                <label>Frame IDs:</label>
                <!-- Populating Data Model Search -->
                <search base="populate">
                    <query>stats count by frameID | dedup frameID | sort 0 frameID</query>
                </search>
                <valuePrefix>frameID=</valuePrefix>
                <delimiter> OR </delimiter>
                <choice value="*">Any</choice>
                <initialValue>*</initialValue>
                <fieldForLabel>frameID</fieldForLabel>
                <fieldForValue>frameID</fieldForValue>
            </input>

            <input type="text" token="host-prefilter" searchWhenChanged="true">
                <label>Optional: Filter hosts populating</label>
                <default>*</default>
            </input>

            <input id="host" type="multiselect" token="host" searchWhenChanged="true">
                <label>Hosts Selection:</label>
                <!-- Populating Data Model Search -->
                <search base="populate">
                    <query>search $frameID$ host=$host-prefilter$
        | stats count by host | dedup host | sort 0 host</query>
                </search>
                <valuePrefix>host="</valuePrefix>
                <valueSuffix>"</valueSuffix>
                <delimiter> OR </delimiter>
                <choice value="*">ALL Hosts</choice>
                <fieldForLabel>host</fieldForLabel>
                <fieldForValue>host</fieldForValue>
                <change>
                    <condition>
                        <unset token="form.host_query_input"></unset>
                    </condition>
                </change>
            </input>

            <!-- hidden form that handles the advanced definition of hosts selection -->

            <input id="host_query_input" type="dropdown" token="host_query" searchWhenChanged="true" depends="$hidden_form$">
                <label>Hosts Selection:</label>
                <search base="populate">
                    <query>search $host$ $frameID$
        | stats values(host) as host
        | format | fields - host | rename search as host</query>
                </search>
                <selectFirstChoice>true</selectFirstChoice>
                <fieldForLabel>host</fieldForLabel>
                <fieldForValue>host</fieldForValue>
            </input>

            <input type="dropdown" token="statsmode" searchWhenChanged="true">
                <label>Select a stats mode:</label>
                <default>max</default>
                <choice value="max">Max</choice>
                <choice value="avg">Avg</choice>
                <choice value="min">Min</choice>
                <choice value="median">Median</choice>
                <choice value="mode">Mode</choice>
                <choice value="range">Range</choice>
            </input>

            <input type="dropdown" token="refresh" searchWhenChanged="true">
                <label>Auto-refresh:</label>
                <fieldForLabel>label</fieldForLabel>
                <fieldForValue>value</fieldForValue>
                <selectFirstChoice>true</selectFirstChoice>
                <search>
                    <query>| `def_auto_refresh`</query>
                    <earliest>$timerange.earliest$</earliest>
                    <latest>$timerange.latest$</latest>
                </search>
            </input>

            <input type="text" token="Command" searchWhenChanged="true">
                <label>Optional: Filter by Command</label>
                <default>*</default>
            </input>

            <input type="text" token="PID" searchWhenChanged="true">
                <label>Optional: Filter by PIDs</label>
                <default>*</default>
            </input>

            <input type="multiselect" token="Command_multiselect" searchWhenChanged="true">
                <label>Command(s):</label>
                <search base="populate_command">
                    <query>sort 0 dimension_Command</query>
                </search>
                <initialValue>*</initialValue>
                <valuePrefix>dimension_Command="</valuePrefix>
                <valueSuffix>"</valueSuffix>
                <delimiter> OR </delimiter>
                <choice value="*">Any</choice>
                <fieldForLabel>dimension_Command</fieldForLabel>
                <fieldForValue>dimension_Command</fieldForValue>
            </input>

        </panel>
    </row>

    <!-- Help the user -->

    <row rejects="$host$">
        <panel>
            <html>
                <div class="red_help_user">
                    <p>- - - - - - - - - - ACTION REQUIRED: please select your server name(s) in the host selector above - - - - - - - - - -</p>
                </div>
            </html>
        </panel>
    </row>

    <row>
        <panel>
            <title>TOP 100 servers by CPU process consumers: bubblechart</title>
            <html>
                <div id="bubbleSearch1"
                     class="splunk-manager"
                     data-require="splunkjs/mvc/searchmanager"
                     data-options='{
                    "search": {
								"type": "token_safe",
                    		"value": "| mstats max(_value) as value where `nmon_metrics_index` metric_name=os.unix.nmon.processes.top.pct_CPU host=$$host-prefilter$$ $$host_query$$ (dimension_Command=$$Command$$) (dimension_PID=$$PID$$) by host, dimension_Command, dimension_PID span=1m
| stats sum(value) as pct_CPU by _time, host, dimension_Command
| eval usage_per_core=(pct_CPU/100)
| stats avg(usage_per_core) as usage_per_core by host | eval usage_per_core=round(usage_per_core, 3) | sort 100 - usage_per_core"
						  },
          			  "earliest_time": {
            				"type": "token_safe",
            				"value": "$$timerange.earliest$$"
          				},
          				"latest_time": {
            				"type": "token_safe",
            				"value": "$$timerange.latest$$"
          				},
                    "auto_cancel": 90,
                    "preview": true
                 }'>
                </div>
                <div id="bubbleChart1"
                     class="splunk-view"
                     data-require="app/metricator-for-nmon/components/bubblechart/bubblechart"
                     data-options='{
                    "managerid": "bubbleSearch1",
                    "nameField": "host",
                    "categoryField": "host",
                    "valueField": "usage_per_core",
                    "height": 600
                 }'>
                </div>
            </html>
        </panel>
        <panel>
            <title>TOP 100 servers by Memory process consumer: bubblechart</title>
            <html>
                <div id="bubbleSearch2"
                     class="splunk-manager"
                     data-require="splunkjs/mvc/searchmanager"
                     data-options='{
                    "search": {
								"type": "token_safe",
                    		"value": "| mstats max(_value) as value where `nmon_metrics_index` metric_name=os.unix.nmon.processes.top.ResSet OR metric_name=os.unix.nmon.processes.top.ResText OR metric_name=os.unix.nmon.processes.top.ResData OR metric_name=os.unix.nmon.processes.top.ResSize host=$$host-prefilter$$ $$host_query$$ (dimension_Command=$$Command$$) (dimension_PID=$$PID$$) by OStype, metric_name, host, dimension_Command, dimension_PID span=1m
| stats sum(value) as value by _time, metric_name, OStype, host, dimension_Command
| `def_all_os_top_memory`
| stats avg(mem_usage_mb) as mem_usage_mb by host | eval mem_usage_mb=round(mem_usage_mb, 3) | sort 100 - mem_usage_mb"
						  },
          			  "earliest_time": {
            				"type": "token_safe",
            				"value": "$$timerange.earliest$$"
          				},
          				"latest_time": {
            				"type": "token_safe",
            				"value": "$$timerange.latest$$"
          				},
                    "auto_cancel": 90,
                    "preview": true
                 }'>
                </div>
                <div id="bubbleChart2"
                     class="splunk-view"
                     data-require="app/metricator-for-nmon/components/bubblechart/bubblechart"
                     data-options='{
                    "managerid": "bubbleSearch2",
                    "nameField": "host",
                    "categoryField": "host",
                    "valueField": "mem_usage_mb",
                    "height": 600
                 }'>
                </div>
            </html>
        </panel>
    </row>

    <row>
        <panel id="process">
            <title>Active drilldown: click on a command invocation to get detailed PIDs statistics of that command (may be truncated with large number of PIDs)</title>

            <input type="text" token="limit" searchWhenChanged="true">
                <label>Max series:</label>
                <default>50</default>
                <prefix>limit=</prefix>
            </input>

            <input type="dropdown" token="timechart_by" searchWhenChanged="true">
                <label>group by statement:</label>
                <default>key</default>
                <choice value="key">host:Command</choice>
                <choice value="dimension_Command">Command</choice>
            </input>

            <input type="dropdown" token="span" searchWhenChanged="true">
                <label>Span:</label>
                <default>`nmon_span`</default>
                <choice value="`nmon_span`">auto</choice>
                <choice value="span=1m">1 minute</choice>
                <choice value="span=2m">2 minutes</choice>
                <choice value="span=3m">3 minutes</choice>
                <choice value="span=4m">4 minutes</choice>
                <choice value="span=5m">5 minutes</choice>
                <choice value="span=10m">10 minutes</choice>
                <choice value="span=15m">15 minutes</choice>
                <choice value="span=30m">30 minutes</choice>
                <choice value="span=1h">1 hour</choice>
                <choice value="span=2h">2 hours</choice>
                <choice value="span=12h">12 hours</choice>
                <choice value="span=4h">4 hours</choice>
                <choice value="span=1d">1 day</choice>
                <choice value="span=2d">2 days</choice>
                <choice value="span=1w">7 days</choice>
                <choice value="span=1mon">1 month</choice>
            </input>

            <input type="dropdown" token="chart_settings" searchWhenChanged="true">
                <label></label>
                <choice value="0">Show charting parameters</choice>
                <choice value="1">Hide charting parameters</choice>
                <default>1</default>
                <change>
                    <condition value="0">
                        <set token="chart_customize">True</set>
                    </condition>
                    <condition value="1">
                        <unset token="chart_customize"></unset>
                    </condition>
                </change>
            </input>

            <input type="dropdown" token="chart" depends="$chart_customize$" searchWhenChanged="true">
                <label>Select a type of chart:</label>
                <default>column</default>
                <choice value="area">Area</choice>
                <choice value="line">Line</choice>
                <choice value="column">Column</choice>
                <choice value="bar">Bar</choice>
            </input>

            <input type="dropdown" token="charting.chart.nullValueMode" depends="$chart_customize$" searchWhenChanged="true">
                <label>Missing Data:</label>
                <default>gaps</default>
                <choice value="gaps">Gaps</choice>
                <choice value="connect">Connect</choice>
                <choice value="zero">Zero</choice>
            </input>

            <input type="dropdown" token="chart.stackingmode" depends="$chart_customize$" searchWhenChanged="true">
                <label>Select a stacking mode:</label>
                <default>stacked</default>
                <choice value="stacked">stacked (lines excluded)</choice>
                <choice value="stacked100">100% stacked (lines excluded)</choice>
                <choice value="unstacked">unstacked</choice>
            </input>

            <input type="dropdown" token="charting.legend.placement" depends="$chart_customize$" searchWhenChanged="true">
                <label>Legend placement:</label>
                <default>bottom</default>
                <choice value="bottom">Bottom</choice>
                <choice value="top">Top</choice>
                <choice value="left">left</choice>
                <choice value="right">right</choice>
                <choice value="none">none</choice>
            </input>

            <input type="link" token="top_linkinput">
                <label></label>
                <choice value="top_chart1">CPU Usage per logical core</choice>
                <choice value="top_chart2">Memory Usage per command invocation</choice>
                <choice value="uarg">UARG: commands arguments</choice>
                <default>top_chart1</default>
                <change>
                    <condition value="top_chart1">
                        <set token="top_chart1">true</set>
                        <unset token="top_chart2"></unset>
                        <unset token="uarg"></unset>
                    </condition>
                    <condition value="top_chart2">
                        <set token="top_chart2">true</set>
                        <unset token="top_chart1"></unset>
                        <unset token="uarg"></unset>
                    </condition>
                    <condition value="uarg">
                        <set token="uarg">true</set>
                        <unset token="top_chart1"></unset>
                        <unset token="top_chart2"></unset>
                    </condition>
                </change>
            </input>

            <chart depends="$top_chart1$">
                <title></title>
                <search depends="$top_chart1$">
                    <query>| mstats max(_value) as value where `nmon_metrics_index` metric_name="os.unix.nmon.processes.top.pct_CPU" host=$host-prefilter$ $host_query$ (dimension_Command=$Command$) (dimension_PID=$PID$) by host dimension_Command dimension_PID span=1m
| stats sum(value) as pct_CPU by _time, host, dimension_Command
| eval usage_per_core=(pct_CPU/100)
| eval key=host . ":" . dimension_Command
| timechart $span$ $limit$ useother=f $statsmode$(usage_per_core) as "CPU Usage per core" by $timechart_by$</query>
                    <earliest>$timerange.earliest$</earliest>
                    <latest>$timerange.latest$</latest>
                    <refresh>$refresh$</refresh>
                    <refreshType>delay</refreshType>
                </search>
                <option name="charting.axisTitleX.visibility">visible</option>
                <option name="charting.axisTitleY.visibility">visible</option>
                <option name="charting.axisX.scale">linear</option>
                <option name="charting.axisY.scale">linear</option>
                <option name="charting.chart">$chart$</option>
                <option name="charting.chart.nullValueMode">$charting.chart.nullValueMode$</option>
                <option name="charting.chart.sliceCollapsingThreshold">0.01</option>
                <option name="charting.chart.stackMode">$chart.stackingmode$</option>
                <option name="charting.chart.style">shiny</option>
                <option name="charting.drilldown">all</option>
                <option name="charting.layout.splitSeries">0</option>
                <option name="charting.legend.labelStyle.overflowMode">ellipsisMiddle</option>
                <option name="charting.legend.placement">$charting.legend.placement$</option>
                <option name="height">500</option>
                <option name="charting.axisTitleX.text">Time</option>
                <option name="charting.axisTitleY.text">Logical Core</option>
                <option name="refresh.display">none</option>
                <drilldown target="search">
                    <link>
                        <![CDATA[
                            search?&earliest=$earliest$&latest=$latest$&q=| mstats max(_value) as pct_CPU where `nmon_metrics_index` metric_name="os.unix.nmon.processes.top.pct_CPU" host=$host-prefilter$ $host_query$ (dimension_Command=$Command$) (dimension_PID=$PID$) by host dimension_Command dimension_PID span=1m
| eval usage_per_core=(pct_CPU/100)
| eval key=host . ":" . dimension_Command . ":" . dimension_PID
| timechart $span$ limit=0 useother=f $statsmode$(usage_per_core) as "CPU Usage per core" by key | rename "aggreg:*" AS "*" | fields _time,$click.name2$*&display.page.search.tab=visualizations&display.general.type=visualizations&display.visualizations.charting.chart=column&display.visualizations.charting.chart.stackMode=stacked
                        ]]>
                    </link>
                </drilldown>
            </chart>

            <chart depends="$top_chart2$">
                <title></title>
                <search depends="$top_chart2$">
                    <query>| mstats max(_value) as value where `nmon_metrics_index` metric_name=os.unix.nmon.processes.top.ResSet OR metric_name=os.unix.nmon.processes.top.ResText OR metric_name=os.unix.nmon.processes.top.ResData OR metric_name=os.unix.nmon.processes.top.ResSize host=$host-prefilter$ $host_query$ (dimension_Command=$Command$) (dimension_PID=$PID$) by OStype, metric_name, host, dimension_Command, dimension_PID span=1m
| stats sum(value) as value by _time, metric_name, OStype, host, dimension_Command
| `def_all_os_top_memory`
| stats sum(mem_usage_mb) As mem_usage_mb by _time, host, dimension_Command
| eval key=host . ":" . dimension_Command
| timechart useother=f limit=0 `nmon_span` sum(mem_usage_mb) as mem_usage_mb by key</query>
                    <earliest>$timerange.earliest$</earliest>
                    <latest>$timerange.latest$</latest>
                    <refresh>$refresh$</refresh>
                    <refreshType>delay</refreshType>
                </search>
                <option name="charting.axisTitleX.visibility">visible</option>
                <option name="charting.axisTitleY.visibility">visible</option>
                <option name="charting.axisX.scale">linear</option>
                <option name="charting.axisY.scale">linear</option>
                <option name="charting.chart">$chart$</option>
                <option name="charting.chart.nullValueMode">$charting.chart.nullValueMode$</option>
                <option name="charting.chart.sliceCollapsingThreshold">0.01</option>
                <option name="charting.chart.stackMode">$chart.stackingmode$</option>
                <option name="charting.chart.style">shiny</option>
                <option name="charting.drilldown">all</option>
                <option name="charting.layout.splitSeries">0</option>
                <option name="charting.legend.labelStyle.overflowMode">ellipsisMiddle</option>
                <option name="charting.legend.placement">$charting.legend.placement$</option>
                <option name="height">500</option>
                <option name="charting.axisTitleX.text">Time</option>
                <option name="charting.axisTitleY.text">Megabytes (MB)</option>
                <option name="refresh.display">none</option>
                <drilldown target="search">
                    <link>
                        <![CDATA[
                            search?&earliest=$earliest$&latest=$latest$&q=| mstats max(_value) as value where `nmon_metrics_index` metric_name=os.unix.nmon.processes.top.ResSet OR metric_name=os.unix.nmon.processes.top.ResText OR metric_name=os.unix.nmon.processes.top.ResData OR metric_name=os.unix.nmon.processes.top.ResSize host=$host-prefilter$ $host_query$ (dimension_Command=$Command$) (dimension_PID=$PID$) by OStype, metric_name, host, dimension_Command, dimension_PID span=1m
| `def_all_os_top_memory`
| eval key=host . ":" . dimension_Command . ":" . dimension_PID
| timechart $span$ limit=0 useother=f $statsmode$(mem_usage_mb) as mem_usage_mb by key | fields _time,$click.name2$*&display.page.search.tab=visualizations&display.general.type=visualizations&display.visualizations.charting.chart=column&display.visualizations.charting.chart.stackMode=stacked
                        ]]>
                    </link>
                </drilldown>
            </chart>

            <input type="text" token="Command" depends="$uarg$" searchWhenChanged="true">
                <label>Optional: Filter by Command</label>
                <default>*</default>
            </input>

            <input type="text" token="PID" depends="$uarg$" searchWhenChanged="true">
                <label>Optional: Filter by PIDs</label>
                <default>*</default>
            </input>

            <input type="multiselect" token="Command_multiselect" depends="$uarg$" searchWhenChanged="true">
                <label>Command(s):</label>
                <search base="populate_command">
                    <query>sort 0 dimension_Command</query>
                </search>
                <initialValue>*</initialValue>
                <valuePrefix>dimension_Command="</valuePrefix>
                <valueSuffix>"</valueSuffix>
                <delimiter> OR </delimiter>
                <choice value="*">Any</choice>
                <fieldForLabel>dimension_Command</fieldForLabel>
                <fieldForValue>dimension_Command</fieldForValue>
            </input>

            <event depends="$uarg$">
                <title></title>
                <search depends="$uarg$">
                    <query>eventtype=nmon:events type=UARG host=$host-prefilter$ $host_query$ ($frameID$) (dimension_Command=$Command$) (dimension_PID=$PID$)</query>
                    <earliest>$timerange.earliest$</earliest>
                    <latest>$timerange.latest$</latest>
                    <refresh>$refresh$</refresh>
                    <refreshType>delay</refreshType>
                </search>
                <option name="count">10</option>
                <option name="list.drilldown">full</option>
                <option name="list.wrap">1</option>
                <option name="maxLines">0</option>
                <option name="raw.drilldown">full</option>
                <option name="rowNumbers">0</option>
                <option name="table.drilldown">1</option>
                <option name="table.wrap">1</option>
                <option name="type">list</option>
                <option name="refresh.display">none</option>
                <fields>[]</fields>
            </event>

        </panel>

    </row>

    <search id="uarg_definition">
        <query>search metric_name=$metric_name$</query>
        <progress>
            <condition>
                <set token="metric_filter">$result.metric_filter$</set>
                <set token="metric_calculation">$result.metric_calculation$</set>
                <set token="metric_has_device">$result.metric_has_device$</set>
                <set token="metric_dimension_field">$result.metric_dimension_field$</set>
                <set token="metric_shortname">$result.metric_shortname$</set>
                <set token="metric_data_field">$result.metric_data_field$</set>
                <set token="metric_primary_statsmode">$result.metric_primary_statsmode$</set>
                <set token="metric_by">$result.metric_by$</set>
                <set token="metric_timechart_by">$result.metric_timechart_by$</set>
                <set token="metric_volume_unit_choice">$result.metric_volume_unit_choice$</set>
                <set token="metric_rate_unit_choice">$result.metric_rate_unit_choice$</set>
                <set token="form.chart">$result.metric_charting_chart$</set>
                <set token="form.chart.stackingmode">$result.metric_charting_stackmode$</set>
            </condition>
        </progress>
    </search>

    <row>
        <panel>
            <table>
                <title>Table stats: CPU Usage per logical core</title>
                <search>
                    <query>| mstats max(_value) as value where `nmon_metrics_index` metric_name="os.unix.nmon.processes.top.pct_CPU" host=$host-prefilter$ $host_query$ (dimension_Command=$Command$) (dimension_PID=$PID$) by host, dimension_Command, dimension_PID span=1m
| stats sum(value) as pct_CPU by _time, host, dimension_Command
| eval usage_per_core=(pct_CPU/100)
| stats $statsmode$(usage_per_core) as "CPU Usage per Logical Cores", sparkline($statsmode$(usage_per_core)) As sparkline by host, dimension_Command
| rename dimension_Command as Command
| eval "CPU Usage per Logical Cores"=round('CPU Usage per Logical Cores', 3)
| sort - "CPU Usage per Logical Cores"</query>
                    <earliest>$timerange.earliest$</earliest>
                    <latest>$timerange.latest$</latest>
                    <refresh>$refresh$</refresh>
                    <refreshType>delay</refreshType>
                </search>
                <option name="wrap">true</option>
                <option name="rowNumbers">false</option>
                <option name="dataOverlayMode">none</option>
                <option name="drilldown">cell</option>
                <option name="count">10</option>
                <option name="refresh.display">none</option>
                <option name="percentagesRow">false</option>
                <!-- Set sparkline options here; make sure that field matches field name of the search results -->
                <format type="sparkline" field="sparkline">
                    <option name="lineColor">#5379af</option>
                    <option name="fillColor">#CCDDFF</option>
                    <option name="lineWidth">1</option>
                    <option name="height">25</option>
                </format>
                <format type="color" field="CPU Usage per Logical Cores">
                    <colorPalette type="minMidMax" maxColor="#31A35F" minColor="#353535"></colorPalette>
                    <scale type="minMidMax"></scale>
                </format>
            </table>
        </panel>
        <panel>
            <table>
                <title>Table stats: Memory Usage per command invocation</title>
                <search>
                    <query>| mstats max(_value) as value where `nmon_metrics_index` metric_name=os.unix.nmon.processes.top.ResSet OR metric_name=os.unix.nmon.processes.top.ResText OR metric_name=os.unix.nmon.processes.top.ResData OR metric_name=os.unix.nmon.processes.top.ResSize host=$host-prefilter$ $host_query$ (dimension_Command=$Command$) (dimension_PID=$PID$) by OStype, metric_name, host, dimension_Command, dimension_PID span=1m
| stats sum(value) as value by _time, metric_name, OStype, host, dimension_Command
| `def_all_os_top_memory`
| stats $statsmode$(mem_usage_mb) as "Used Memory per Command (MB)", sparkline($statsmode$(mem_usage_mb)) as sparkline by host, dimension_Command
| rename dimension_Command as Command
| eval "Used Memory per Command (MB)"=round('Used Memory per Command (MB)', 3)
| sort - "Used Memory per Command (MB)"</query>
                    <earliest>$timerange.earliest$</earliest>
                    <latest>$timerange.latest$</latest>
                    <refresh>$refresh$</refresh>
                    <refreshType>delay</refreshType>
                </search>
                <option name="wrap">true</option>
                <option name="rowNumbers">false</option>
                <option name="dataOverlayMode">none</option>
                <option name="drilldown">cell</option>
                <option name="count">10</option>
                <option name="refresh.display">none</option>
                <option name="percentagesRow">false</option>
                <!-- Set sparkline options here; make sure that field matches field name of the search results -->
                <format type="sparkline" field="sparkline">
                    <option name="lineColor">#5379af</option>
                    <option name="fillColor">#CCDDFF</option>
                    <option name="lineWidth">1</option>
                    <option name="height">25</option>
                </format>
                <format type="color" field="Used Memory per Command (MB)">
                    <colorPalette type="minMidMax" maxColor="#31A35F" minColor="#353535"></colorPalette>
                    <scale type="minMidMax"></scale>
                </format>
            </table>
        </panel>
    </row>
</form>
