# macros.conf

##############
# NMON index #
##############

##### Customization ####
# The default model implements a dual index notion:
# "nmon_events": for all regular events (index type: Events)
# "nmon_metrics": for all metrics indexed as native metrics (index type: Metrics)
# You can easily have your own indexes naming convention and/or have more than the 2 defaults indexes (ex. split between Production and non Production)
# To achieve this, simply create your local/macros.conf and customize the indexes definition up to your needs
########################

# This should match all indexes, events and metrics
[nmon_index]
definition = index="os-unix-nmon-*"
iseval = 0

# This should match all indexes, events and metrics
[nmon_idx]
definition = idx="os-unix-nmon-*"
iseval = 0

# metrics indexes, the definition should match all nmon events indexes
[nmon_events_index]
definition = index="os-unix-nmon-events*"
iseval = 0

# metrics indexes, the definition should match all metrics indexes
[nmon_metrics_index]
definition = index="os-unix-nmon-metrics*"
iseval = 0

########################################
# auto-refresh
########################################

# This macro is used to define the options available for auto-refresh in dashboards, their order, the default selection and behaviour when looking at past data.
# You can transparently customize the macro to match your needs and requirements, if for example you prefer to have no auto refresh by default, or a different value than the one provided by default
# If you need to so, create a local copy of the macro bellow and modify it up to your needs.

# - The "none" should not be removed, but its default priority can be changed
# - the evaluation will ensure that if the user is looking at past period, the auto-refresh is deactivated automatically as it would be point less
# - The final order is sorted by priority, from the biggest to the lowest value

[def_auto_refresh]
definition = makeresults | eval label="30 sec", value="30s", priority=5\
| append [ | makeresults | eval label="1 min", value="60s", priority=4 ]\
| append [ | makeresults | eval label="5 min", value="300s", priority=3 ]\
| append [ | makeresults | eval label="none", value="0", priority=0 ]\
| addinfo | fields - _time\
| eval now=now(), delta_now=(now - info_max_time), is_past_search=if((delta_now >= 300),"true","false"), priority=if(((label == "none") AND (is_past_search == "true")),100,priority)\
| sort 0 - priority\
| fields label,value,priority
iseval = 0

########################################
# metric filters macros
########################################

# Using wildcards have performance hits within metric filters
# as much as possible we avoid this

# CPU filters for all OS
[def_cpu_all_os_metric_filters]
definition = metric_name=os.unix.nmon.cpu.cpu_all.Sys_PCT\
OR metric_name=os.unix.nmon.cpu.cpu_all.User_PCT\
OR metric_name=os.unix.nmon.cpu.cpu_all.Wait_PCT\
OR metric_name=os.unix.nmon.cpu.cpu_all.Idle_PCT\
OR metric_name=os.unix.nmon.cpu.cpu_all.Steal_PCT\
OR metric_name=os.unix.nmon.cpu.lpar.VP_Sys_PCT\
OR metric_name=os.unix.nmon.cpu.lpar.VP_User_PCT\
OR metric_name=os.unix.nmon.cpu.lpar.VP_Wait_PCT\
OR metric_name=os.unix.nmon.cpu.lpar.VP_Idle_PCT\
OR metric_name=os.unix.nmon.cpu.lpar.entitled\
OR metric_name=os.unix.nmon.cpu.lpar.virtualCPUs
iseval = 0

# memory filters for Linux OS
[def_memory_linux_metric_filters]
definition = metric_name=os.unix.nmon.memory.mem.memtotal\
OR metric_name=os.unix.nmon.memory.mem.active\
OR metric_name=os.unix.nmon.memory.mem.inactive\
OR metric_name=os.unix.nmon.memory.mem.buffers\
OR metric_name=os.unix.nmon.memory.mem.cached\
OR metric_name=os.unix.nmon.memory.mem.memfree\
OR metric_name=os.unix.nmon.memory.mem.swapcached\
OR metric_name=os.unix.nmon.memory.mem.swaptotal\
OR metric_name=os.unix.nmon.memory.mem.swapfree
iseval = 0

# memory filters for AIX OS
[def_memory_AIX_metric_filters]
definition = metric_name=os.unix.nmon.memory.memnew.System_PCT\
OR metric_name=os.unix.nmon.memory.memnew.Process_PCT\
OR metric_name=os.unix.nmon.memory.mem.Real_total_MB\
OR metric_name=os.unix.nmon.memory.mem.Virtual_free_MB\
OR metric_name=os.unix.nmon.memory.mem.Virtual_free_PCT\
OR metric_name=os.unix.nmon.memory.mem.Virtual_total_MB
iseval = 0

# physical memory filters for All OS
[def_phys_memory_all_os_metric_filters]
definition = metric_name=os.unix.nmon.memory.mem.memtotal\
OR metric_name=os.unix.nmon.memory.mem.active\
OR metric_name=os.unix.nmon.memory.mem.inactive\
OR metric_name=os.unix.nmon.memory.mem.buffers\
OR metric_name=os.unix.nmon.memory.mem.cached\
OR metric_name=os.unix.nmon.memory.mem.memfree\
OR metric_name=os.unix.nmon.memory.memnew.System_PCT\
OR metric_name=os.unix.nmon.memory.memnew.Process_PCT\
OR metric_name=os.unix.nmon.memory.mem.Real_total_MB
iseval = 0

# physical and virtual memory filters for All OS
[def_memory_all_os_metric_filters]
definition = metric_name=os.unix.nmon.memory.mem.memtotal\
OR metric_name=os.unix.nmon.memory.mem.active\
OR metric_name=os.unix.nmon.memory.mem.inactive\
OR metric_name=os.unix.nmon.memory.mem.buffers\
OR metric_name=os.unix.nmon.memory.mem.cached\
OR metric_name=os.unix.nmon.memory.mem.memfree\
OR metric_name=os.unix.nmon.memory.memnew.System_PCT\
OR metric_name=os.unix.nmon.memory.memnew.Process_PCT\
OR metric_name=os.unix.nmon.memory.memnew.FScache_PCT\
OR metric_name=os.unix.nmon.memory.mem.Real_total_MB\
OR metric_name=os.unix.nmon.memory.mem.swapcached\
OR metric_name=os.unix.nmon.memory.mem.swaptotal\
OR metric_name=os.unix.nmon.memory.mem.swapfree\
OR metric_name=os.unix.nmon.memory.mem.Virtual_total_MB\
OR metric_name=os.unix.nmon.memory.mem.Virtual_free_MB
iseval = 0

# lpar filters for AIX OS
[def_lpar_AIX_metric_filters]
definition = metric_name=os.unix.nmon.cpu.lpar.VP_Sys_PCT\
OR metric_name=os.unix.nmon.cpu.lpar.VP_User_PCT\
OR metric_name=os.unix.nmon.cpu.lpar.VP_Wait_PCT\
OR metric_name=os.unix.nmon.cpu.lpar.VP_Idle_PCT\
OR metric_name=os.unix.nmon.cpu.lpar.EC_Sys_PCT\
OR metric_name=os.unix.nmon.cpu.lpar.EC_User_PCT\
OR metric_name=os.unix.nmon.cpu.lpar.EC_Wait_PCT\
OR metric_name=os.unix.nmon.cpu.lpar.EC_Idle_PCT\
OR metric_name=os.unix.nmon.cpu.lpar.entitled\
OR metric_name=os.unix.nmon.cpu.lpar.virtualCPUs
iseval = 0

########################################
# metric definitions macros
########################################

# Generic metrics extraction
[extract_metrics]
definition = rex field="metric_name" ".(?<metric>[\w|\-|\_]*)$"
iseval = 0

# Generic metrics extraction with the fields list in argument
[extract_metrics(1)]
args = fields_list
definition = `extract_metrics`\
| foreach $fields_list$ [ eval "<<FIELD>>" = case(metric="<<FIELD>>", value) ]
iseval = 0

# Extract metrics for cpu_all
[extract_metrics_cpu_all(1)]
args = fields_list
definition = rex field="metric_name" "os\.unix\.nmon\.\w*\.\w*\.(?<cpu_core>\w*)\.(?<metric>\w*)"\
| foreach $fields_list$ [ eval "<<FIELD>>" = case(metric="<<FIELD>>", value) ]
iseval = 0

# Extract metrics for dimensions and create a key field per metric / dimension
[extract_metrics_by_key]
definition = rex field=metric_name ".(?<metric>[\w|\-|\_]*)$"\
| eval key = metric . ":" . dimension_device
iseval = 0

# All these macros are used to reduce searches complexity in various dashboards
# the macros are expected to be used after the mstats command

# define the standard cpu load in percent
[def_cpu_load_percent]
definition = eval Sys_percent=case(metric_name=="os.unix.nmon.cpu.cpu_all.Sys_PCT", value), User_percent=case(metric_name=="os.unix.nmon.cpu.cpu_all.User_PCT", value), Wait_percent=case(metric_name=="os.unix.nmon.cpu.cpu_all.Wait_PCT", value), Steal_percent=case(metric_name=="os.unix.nmon.cpu.cpu_all.Steal_PCT", value)\
| stats values(Sys_percent) as Sys_percent, values(User_percent) as User_percent, values(Wait_percent) as Wait_percent, values(Steal_percent) as Steal_percent by _time, host\
| fillnull value=0 Sys_percent,User_percent,Wait_percent,Steal_percent\
| eval cpu_load_percent=(Sys_percent+User_percent+Wait_percent+Steal_percent)\
| fields _time, host, cpu_load_percent
iseval = 0

# define the lpar (AIX or Linux) VP load in percent
[def_lpar_load_percent]
definition = `extract_metrics`\
| eval {metric}=value\
| stats values(VP_User_PCT) as VP_User_PCT, values(VP_Sys_PCT) as VP_Sys_PCT, values(VP_Wait_PCT) as VP_Wait_PCT, values(VP_Idle_PCT) as VP_Idle_PCT, values(PhysicalCPU) as PhysicalCPU, values(virtualCPUs) as virtualCPUs values(partition_active_processors) as partition_active_processors by _time, OStype, host\
| fillnull value=0 VP_User_PCT,VP_Sys_PCT,VP_Wait_PCT,VP_Idle_PCT,PhysicalCPU,partition_active_processors\
| eval lpar_load_percent = case(OStype=="AIX", round((VP_User_PCT+VP_Sys_PCT+VP_Wait_PCT+VP_Idle_PCT),2), OStype=="Linux", round((PhysicalCPU/partition_active_processors*100),2))\
| fields _time, host, lpar_load_percent
iseval = 0

# define the merged cpu_all / lpar load in percent
[def_all_os_cpu_load_percent]
definition = `extract_metrics`\
| eval {metric}=value\
| stats values(Sys_PCT) as Sys_PCT, values(User_PCT) as User_PCT, values(Wait_PCT) as Wait_PCT, values(Steal_PCT) as Steal_PCT, values(VP_User_PCT) as VP_User_PCT, values(VP_Sys_PCT) as VP_Sys_PCT, values(VP_Wait_PCT) as VP_Wait_PCT, values(VP_Idle_PCT) as VP_Idle_PCT, values(PhysicalCPU) as PhysicalCPU, values(virtualCPUs) as virtualCPUs values(partition_active_processors) as partition_active_processors by _time, OStype, host\
| fillnull value=0 Sys_PCT,User_PCT,Wait_PCT,Steal_PCT,VP_User_PCT,VP_Sys_PCT,VP_Wait_PCT,VP_Idle_PCT,PhysicalCPU,partition_active_processors\
| eval cpu_all_load_percent=(Sys_PCT+User_PCT+Wait_PCT+Steal_PCT), lpar_load_percent = case(OStype=="AIX", round((VP_User_PCT+VP_Sys_PCT+VP_Wait_PCT+VP_Idle_PCT),2), OStype=="Linux", round((PhysicalCPU/partition_active_processors*100),2))\
| eventstats count(eval(lpar_load_percent>0)) as count_lpar by host\
| eval cpu_load_percent=if(count_lpar>0, lpar_load_percent, cpu_all_load_percent)\
| fields _time, host, cpu_load_percent
iseval = 0

# define the merged cpu_all / lpar load in percent by category
[def_all_os_cpu_load_percent_by_category]
definition = `extract_metrics`\
| eval {metric}=value\
| stats values(Sys_PCT) as Sys_PCT, values(User_PCT) as User_PCT, values(Wait_PCT) as Wait_PCT, values(Idle_PCT) as Idle_PCT, values(Steal_PCT) as Steal_PCT, values(VP_User_PCT) as VP_User_PCT, values(VP_Sys_PCT) as VP_Sys_PCT, values(VP_Wait_PCT) as VP_Wait_PCT, values(VP_Idle_PCT) as VP_Idle_PCT by _time, host\
| eventstats count(eval(VP_Sys_PCT>0)) as count_lpar by host\
| fillnull value=0 Sys_PCT User_PCT Wait_PCT Steal_PCT VP_User_PCT VP_Sys_PCT VP_Wait_PCT VP_Idle_PCT\
| eval Sys_PCT=if(OStype=="AIX" AND count_lpar>0, VP_Sys_PCT, Sys_PCT),\
User_PCT=if(OStype=="AIX" AND count_lpar>0, VP_Sys_PCT, Sys_PCT),\
Wair_PCT=if(OStype=="AIX" AND count_lpar>0, VP_Wait_PCT, Wait_PCT),\
Idle_PCT=if(OStype=="AIX" AND count_lpar>0, VP_Idle_PCT, Idle_PCT)
iseval = 0

# define the cpu_all load in percent by category
[def_cpu_all_cpu_load_percent_by_category]
definition = `extract_metrics`\
| eval {metric}=value\
| stats values(Sys_PCT) as Sys_PCT, values(User_PCT) as User_PCT, values(Wait_PCT) as Wait_PCT, values(Idle_PCT) as Idle_PCT by _time, host
iseval = 0

# define the lpar (AIX or Linux) VP load in cores
[def_lpar_load_cores]
definition = `extract_metrics`\
| eval {metric}=value\
| stats values(VP_User_PCT) as VP_User_PCT, values(VP_Sys_PCT) as VP_Sys_PCT, values(VP_Wait_PCT) as VP_Wait_PCT, values(VP_Idle_PCT) as VP_Idle_PCT, values(PhysicalCPU) as PhysicalCPU, values(entitled) as entitled, values(virtualCPUs) as virtualCPUs by _time, OStype, host\
| fillnull value=0 VP_User_PCT VP_Sys_PCT VP_Wait_PCT VP_Idle_PCT PhysicalCPU entitled virtualCPUs\
| eval lpar_load_cores=case(OStype=="AIX", round(((VP_User_PCT+VP_Sys_PCT+VP_Wait_PCT+VP_Idle_PCT)*virtualCPUs/100),3), OStype=="Linux", round(PhysicalCPU,3))
iseval = 0

# define the lpar (Linux) VP load in cores
[def_lpar_load_linux_cores]
definition = `extract_metrics`\
| eval {metric}=value\
| stats values(PhysicalCPU) as lpar_load_cores, values(partition_active_processors) as partition_active_processors, values(partition_entitled_capacity) as partition_entitled_capacity by _time, host
iseval = 0

# define the lpar (Linux) VP load in percent
[def_lpar_load_linux_percent]
definition = `extract_metrics`\
| eval {metric}=value\
| stats values(PhysicalCPU) as PhysicalCPU, values(partition_active_processors) as partition_active_processors, values(partition_entitled_capacity) as partition_entitled_capacity by _time, host\
| fillnull value=0 PhysicalCPU partition_active_processors\
| eval lpar_load_percent = round((PhysicalCPU/partition_active_processors*100),2)
iseval = 0

############
# AIX only #
############

# define the lpar (AIX) VP load in cores
[def_lpar_load_vp_aix_cores]
definition = `extract_metrics`\
| eval {metric}=value\
| stats values(VP_User_PCT) as VP_User_PCT, values(VP_Sys_PCT) as VP_Sys_PCT, values(VP_Wait_PCT) as VP_Wait_PCT, values(VP_Idle_PCT) as VP_Idle_PCT, values(entitled) as entitled, values(virtualCPUs) as virtualCPUs by _time, host\
| fillnull value=0 VP_User_PCT VP_Sys_PCT VP_Wait_PCT VP_Idle_PCT entitled virtualCPUs\
| eval lpar_load_cores=round(((VP_User_PCT+VP_Sys_PCT+VP_Wait_PCT+VP_Idle_PCT)*virtualCPUs/100),3)
iseval = 0

# define the lpar (AIX) VP load in percent
[def_lpar_load_vp_aix_percent]
definition = `extract_metrics`\
| eval {metric}=value\
| stats values(VP_User_PCT) as VP_User_PCT, values(VP_Sys_PCT) as VP_Sys_PCT, values(VP_Wait_PCT) as VP_Wait_PCT, values(VP_Idle_PCT) as VP_Idle_PCT by _time, host\
| fillnull value=0 VP_User_PCT VP_Sys_PCT VP_Wait_PCT VP_Idle_PCT\
| eval lpar_load_percent = round((VP_User_PCT+VP_Sys_PCT+VP_Wait_PCT+VP_Idle_PCT),2)\
| fields _time, host, lpar_load_percent
iseval = 0

# define the lpar (AIX) EC load in cores
[def_lpar_load_ec_aix_cores]
definition = `extract_metrics`\
| eval {metric}=value\
| stats values(EC_User_PCT) as EC_User_PCT, values(EC_Sys_PCT) as EC_Sys_PCT, values(EC_Wait_PCT) as EC_Wait_PCT, values(EC_Idle_PCT) as EC_Idle_PCT, values(entitled) as entitled, values(virtualCPUs) as virtualCPUs by _time, host\
| fillnull value=0 EC_User_PCT EC_Sys_PCT EC_Wait_PCT EC_Idle_PCT virtualCPUs entitled\
| eval lpar_load_cores=round(((EC_User_PCT+EC_Sys_PCT+EC_Wait_PCT+EC_Idle_PCT)*virtualCPUs/100),3)
iseval = 0

# define the lpar (AIX) EC load in percent
[def_lpar_load_ec_aix_percent]
definition = `extract_metrics`\
| eval {metric}=value\
| stats values(EC_User_PCT) as EC_User_PCT, values(EC_Sys_PCT) as EC_Sys_PCT, values(EC_Wait_PCT) as EC_Wait_PCT, values(EC_Idle_PCT) as EC_Idle_PCT by _time, host\
| fillnull value=0 EC_User_PCT EC_Sys_PCT EC_Wait_PCT EC_Idle_PCT virtualCPUs entitled\
| eval lpar_load_percent = round((EC_User_PCT+EC_Sys_PCT+EC_Wait_PCT+EC_Idle_PCT),2)\
| fields _time, host, lpar_load_percent
iseval = 0

# define the lpar (AIX) VP load in cores with entitlement and VirtualCPUs
[def_lpar_load_aix_cores_by_cat]
definition = `extract_metrics`\
| eval {metric}=value\
| stats values(VP_User_PCT) as VP_User_PCT, values(VP_Sys_PCT) as VP_Sys_PCT, values(VP_Wait_PCT) as VP_Wait_PCT, values(VP_Idle_PCT) as VP_Idle_PCT, values(entitled) as entitled, values(virtualCPUs) as virtualCPUs by _time, OStype, host
iseval = 0

# define the lpar (AIX) Pool VP load in cores
[def_lpar_pool_load_aix_cores]
definition = `extract_metrics`\
| eval {metric}=value\
| stats values(poolCPUs) as poolCPUs, values(Pool_id) as Pool_id, values(PoolIdle) as PoolIdle by _time, host\
| fillnull value=0 poolCPUs PoolIdle\
| eval lpar_pool_usage = round((poolCPUs-PoolIdle),3)
iseval = 0

# define the lpar (AIX) Pool VP load in percentage of capacity
[def_lpar_pool_load_aix_percent]
definition = `extract_metrics`\
| eval {metric}=value\
| stats values(poolCPUs) as poolCPUs, values(Pool_id) as Pool_id, values(PoolIdle) as PoolIdle by _time, host\
| fillnull value=0 poolCPUs PoolIdle\
| eval lpar_pool_usage_percent = round(((poolCPUs-PoolIdle)*100/poolCPUs),2)
iseval = 0

# define the WLM (AIX) statistics
[def_wlm_aix_percent]
definition = `extract_metrics`\
| eval {metric}=value\
| stats values(wlmcpu) as wlmcpu, values(wlmmem) as wlmmem, values(wlmbio) as wlmbio by _time, host, dimension_device
iseval = 0

############
# Linux only
############

# define the lpar (Linux) Pool VP load in cores
[def_lpar_pool_load_linux_cores]
definition = `extract_metrics`\
| eval {metric}=value\
| stats values(smt_mode) as smt_mode, values(pool_idle_time) as pool_idle_time, values(pool_capacity) as pool_capacity by _time, host\
| eval lpar_pool_vp_usage = case(pool_idle_time>"0.1" AND pool_idle_time<(pool_capacity/100), round((((pool_capacity/100)-pool_idle_time)/smt_mode),3))
iseval = 0

# table stats report of percentage memory
[def_memory_percentage_linux_report]
definition = `extract_metrics`\
| eval {metric}=value\
| stats values(memtotal) as memtotal, values(buffers) as buffers, values(active) as active, values(inactive) as inactive, values(cached) as cached, values(memfree) as memfree,\
values(swapcached) as swapcached, values(swaptotal) as swaptotal, values(swapfree) as swapfree by _time, host\
| fillnull value=0 memtotal buffers active inactive cached memfree swapcached swaptotal swapfree\
| eval mem_used_effective=case(isnotnull(cached), round((((((memtotal-(buffers+cached))-memfree))/memtotal)*100),2), isnotnull(memtotal), round((((memtotal-memfree)/memtotal)*100),2))\
| eval mem_free_effective = case(isnotnull(cached), round((((memfree+(buffers+cached))/memtotal)*100),2), isnotnull(memtotal), round(((memfree/memtotal)*100),2))\
| eval swap_used_effective=case(isnotnull(swapcached), round((((((swaptotal-swapfree)-swapcached))/swaptotal)*100),2), isnotnull(swaptotal), round((((swaptotal-swapfree)/swaptotal)*100),2))\
| eval swap_free_effective=case(isnotnull(swapcached), round((((swapfree+swapcached)/swaptotal)*100),2), isnotnull(swapfree), round(((swapfree/swaptotal)*100),2))\
| eval swapcached = case(isnotnull(swapcached), round(((swapcached/swaptotal)*100),2))\
| eval cached = case(isnotnull(cached), round(((cached/memtotal)*100),2)), buffers = case(isnotnull(buffers), round(((buffers/memtotal)*100),2)),\
active = case(isnotnull(active), round(((active/memtotal)*100),2)), inactive = case(isnotnull(inactive), round(((inactive/memtotal)*100),2))\
| fields - memtotal, memfree, memtotal, swaptotal, swapfree\
| stats avg(*) as "*" by host\
| rename "*_PCT" as "*"\
| fields host, "mem*total*", "mem*used*", "mem*free*", active, inactive, buffers, cached, "swap*total*", "swap*used*", "swap*free*", *\
| rename "mem*" AS "mem* (%)", "swap*" AS "swap* (%)", active as "active (%)", inactive as "inactive (%)", buffers as "buffers (%)", cached as "cached (%)"\
| foreach "*%*" [ eval "<<FIELD>>"=round('<<FIELD>>', 2) ]
iseval = 0

# table stats report of volume memory
[def_memory_volume_linux_report]
definition = `extract_metrics`\
| eval {metric}=value\
| stats values(memtotal) as memtotal, values(buffers) as buffers, values(active) as active, values(inactive) as inactive, values(cached) as cached, values(memfree) as memfree,\
values(swapcached) as swapcached, values(swaptotal) as swaptotal, values(swapfree) as swapfree by _time, host\
| fillnull value=0 memtotal buffers active inactive cached memfree swapcached swaptotal swapfree\
| eval mem_used_effective = case(isnotnull(cached), ((memtotal-(buffers+cached))-memfree), isnotnull(memtotal), memtotal-memfree)\
| eval swap_used_effective = case(isnotnull(swapcached), ((swaptotal-swapfree)-swapcached), isnotnull(swaptotal), (swaptotal-swapfree))\
| stats avg(*) as "*" by host\
| fields host, "mem*total*", "mem*used*", "mem*free*", active, inactive, buffers, cached, "swap*total*", "swap*used*", "swap*free*", *\
| rename "mem*" AS "mem* (MB)", "swap*" AS "swap* (MB)", active as "active (MB)", inactive as "inactive (MB)", buffers as "buffers (MB)", cached as "cached (MB)"\
| foreach "*MB*" [ eval "<<FIELD>>"=round('<<FIELD>>', 0) ]
iseval = 0

########
# Others
########

# define the lpar (All OS) Pool VP load in cores
[def_all_os_lpar_pool_load_cores]
definition = `extract_metrics`\
| eval {metric}=value\
| stats values(poolCPUs) as poolCPUs, values(PoolIdle) as PoolIdle, values(pool_idle_time) as pool_idle_time, values(pool_capacity) as pool_capacity, values(smt_mode) as smt_mode, values(Pool_id) as Pool_id by _time, OStype, host\
| fillnull value=0 poolCPUs PoolIdle pool_idle_time pool_capacity smt_mode Pool_id\
| eval lpar_pool_vp_usage = case(OStype=="AIX", round((poolCPUs-PoolIdle),3), OStype="Linux", case(pool_idle_time>"0.1" AND pool_idle_time<(pool_capacity/100), round((((pool_capacity/100)-pool_idle_time)/smt_mode),3)) )
iseval = 0

# define the lpar (All OS) Pool VP load in percentage of capacity
[def_all_os_lpar_pool_load_percent]
definition = `extract_metrics`\
| eval {metric}=value\
| stats values(poolCPUs) as poolCPUs, values(PoolIdle) as PoolIdle, values(pool_idle_time) as pool_idle_time, values(pool_capacity) as pool_capacity, values(smt_mode) as smt_mode, values(Pool_id) as Pool_id by _time, OStype, host\
| fillnull value=0 poolCPUs PoolIdle pool_idle_time pool_capacity smt_mode Pool_id\
| eval lpar_pool_vp_usage_PCT = case(OStype=="AIX", round(((poolCPUs-PoolIdle)*100/poolCPUs),2), OStype="Linux", case(pool_idle_time>"0.1" AND pool_idle_time<(pool_capacity/100), round((((pool_capacity/100)-pool_idle_time)/smt_mode)/(pool_capacity/100)*100,2)) )
iseval = 0

# define the lpar load and pool load (All OS) in VP
[def_all_os_lpar_load_and_pool_load_cores]
definition = `extract_metrics`\
| eval {metric}=value\
| stats values(VP_User_PCT) as VP_User_PCT, values(VP_Sys_PCT) as VP_Sys_PCT, values(VP_Wait_PCT) as VP_Wait_PCT, values(VP_Idle_PCT) as VP_Idle_PCT, values(PhysicalCPU) as PhysicalCPU, values(entitled) as entitled, values(virtualCPUs) as virtualCPUs, values(poolCPUs) as poolCPUs, values(PoolIdle) as PoolIdle, values(pool_idle_time) as pool_idle_time, values(pool_capacity) as pool_capacity, values(smt_mode) as smt_mode, values(Pool_id) as Pool_id by _time, OStype, host\
| fillnull value=0 VP_User_PCT VP_Sys_PCT VP_Wait_PCT VP_Idle_PCT PhysicalCPU entitled virtualCPUs poolCPUs PoolIdle pool_idle_time pool_capacity smt_mode Pool_id\
| eval lpar_load_cores=case(OStype=="AIX", round(((VP_User_PCT+VP_Sys_PCT+VP_Wait_PCT+VP_Idle_PCT)*virtualCPUs/100),3), OStype=="Linux", round(PhysicalCPU,3))\
| eval lpar_pool_vp_usage = case(OStype=="AIX", round((poolCPUs-PoolIdle),3), OStype="Linux", case(pool_idle_time>"0.1" AND pool_idle_time<(pool_capacity/100), round((((pool_capacity/100)-pool_idle_time)/smt_mode),3)) )\
| fields _time, host, lpar_load_cores, lpar_pool_vp_usage
iseval = 0

# define for all OS memory and swap usage in percent
[def_memory_load_percent]
definition = `extract_metrics`\
| eval {metric}=value\
| stats values(System_PCT) as System_PCT, values(Process_PCT) as Process_PCT, values(memtotal) as memtotal, values(buffers) as buffers, values(cached) as cached, values(memfree) as memfree,\
values(Virtual_total_MB) as Virtual_total_MB, values(Virtual_free_MB) as Virtual_free_MB, values(swapcached) as swapcached, values(swaptotal) as swaptotal, values(swapfree) as swapfree by _time, OStype, host\
| fillnull value=0 System_PCT Process_PCT memtotal buffers cached memfree Virtual_total_MB Virtual_free_MB swapcached swaptotal swapfree\
| eval mem_used_effective_PCT=case(OStype == "AIX",round((System_PCT+Process_PCT),2), OStype=="Linux", round((((((memtotal-(buffers+cached))-memfree))/memtotal)*100),2), OStype=="Solaris", round((((memtotal-memfree)/memtotal)*100),2))\
| eval swap_used_effective_PCT=case(OStype=="AIX", round((((Virtual_total_MB-Virtual_free_MB)/Virtual_total_MB)*100),2), OStype=="Linux", round((((((swaptotal-swapfree)-swapcached))/swaptotal)*100),2), OStype=="Solaris", round((((swaptotal-swapfree)/swaptotal)*100),2))\
| fields _time, host, mem_used_effective_PCT, swap_used_effective_PCT
iseval = 0

# define for Linux OS memory and swap usage in percent
[def_memory_load_percent_linux]
definition = `extract_metrics`\
| eval {metric}=value\
| stats values(memtotal) as memtotal, values(buffers) as buffers, values(cached) as cached, values(memfree) as memfree,\
values(swapcached) as swapcached, values(swaptotal) as swaptotal, values(swapfree) as swapfree by _time, host\
| fillnull value=0 memtotal buffers cached memfree swapcached swaptotal swapfree\
| eval mem_used_effective_PCT=round((((((memtotal-(buffers+cached))-memfree))/memtotal)*100),2)\
| eval swap_used_effective_PCT=round((((((swaptotal-swapfree)-swapcached))/swaptotal)*100),2)\
| fields _time, host, mem_used_effective_PCT, swap_used_effective_PCT
iseval = 0

# define for all OS memory and swap usage in percent
[def_memory_load_percent_all_metrics]
definition = `extract_metrics`\
| eval {metric}=value\
| stats values(System_PCT) as System_PCT, values(Process_PCT) as Process_PCT, values(memtotal) as memtotal, values(buffers) as buffers, values(active) as active, values(inactive) as inactive, values(cached) as cached, values(memfree) as memfree,\
values(Virtual_total_MB) as Virtual_total_MB, values(Virtual_free_MB) as Virtual_free_MB, values(swapcached) as swapcached, values(swaptotal) as swaptotal, values(swapfree) as swapfree by _time, OStype, host\
| fillnull value=0 System_PCT Process_PCT memtotal buffers active inactive cached memfree Virtual_total_MB Virtual_free_MB swapcached swaptotal swapfree\
| eval mem_used_effective=case(OStype == "AIX",round((System_PCT+Process_PCT),2), OStype=="Linux", round((((((memtotal-(buffers+cached))-memfree))/memtotal)*100),2), OStype=="Solaris", round((((memtotal-memfree)/memtotal)*100),2))\
| eval mem_free_effective = case((OStype == "AIX"),round((100-(System_PCT+Process_PCT)),2), OStype=="Linux", round((((memfree+(buffers+cached))/memtotal)*100),2), OStype=="Solaris", round(((memfree/memtotal)*100),2))\
| eval swap_used_effective=case(OStype=="AIX", round((((Virtual_total_MB-Virtual_free_MB)/Virtual_total_MB)*100),2), OStype=="Linux", round((((((swaptotal-swapfree)-swapcached))/swaptotal)*100),2), OStype=="Solaris", round((((swaptotal-swapfree)/swaptotal)*100),2))\
| eval swap_free_effective=case(OStype=="AIX", Virtual_free_PCT, OStype=="Linux", round((((swapfree+swapcached)/swaptotal)*100),2), OStype=="Solaris", round(((swapfree/swaptotal)*100),2))\
| eval swapcached = case(OStype=="Linux", round(((swapcached/swaptotal)*100),2))\
| eval cached = case(OStype=="Linux", round(((cached/memtotal)*100),2)), buffers = case(OStype=="Linux", round(((buffers/memtotal)*100),2)),\
active = case(OStype=="Linux", round(((active/memtotal)*100),2)), inactive = case(OStype=="Linux", round(((inactive/memtotal)*100),2))\
| fields - memtotal, memfree, memtotal, swaptotal, swapfree
iseval = 0

# define for all OS memory and swap usage in volume (MB)
[def_memory_volume_MB]
definition = `extract_metrics`\
| eval {metric}=value\
| stats values(Real_total_MB) as Real_total_MB, values(System_PCT) as System_PCT, values(Process_PCT) as Process_PCT, values(memtotal) as memtotal, values(buffers) as buffers, values(active) as active, values(inactive) as inactive, values(cached) as cached, values(memfree) as memfree,\
values(Virtual_total_MB) as Virtual_total_MB, values(Virtual_free_MB) as Virtual_free_MB, values(swapcached) as swapcached, values(swaptotal) as swaptotal, values(swapfree) as swapfree by _time, OStype, host\
| fillnull value=0 Real_total_MB System_PCT Process_PCT memtotal buffers active inactive cached memfree Virtual_total_MB Virtual_free_MB swapcached swaptotal swapfree\
| eval mem_used_effective = case(OStype=="AIX", (Real_total_MB/100)*(System_PCT+Process_PCT), OStype=="Linux", ((memtotal-(buffers+cached))-memfree), OStype=="Solaris", memtotal-memfree)\
| eval swap_used_effective = case(OStype=="AIX", (Virtual_total_MB-Virtual_free_MB), OStype=="Linux", ((swaptotal-swapfree)-swapcached), OStype=="Solaris", (swaptotal-swapfree))
iseval = 0

# define for all OS memory by category in volume (MB)
[def_memory_volume_MB_by_category]
definition = `extract_metrics`\
| eval {metric}=value\
| stats values(Real_total_MB) as Real_total_MB, values(System_PCT) as System_PCT, values(Process_PCT) as Process_PCT, values(FScache_PCT) as FScache_PCT, values(memtotal) as memtotal, values(buffers) as buffers, values(cached) as cached, values(memfree) as memfree,\
values(Virtual_total_MB) as Virtual_total_MB, values(Virtual_free_MB) as Virtual_free_MB, values(swapcached) as swapcached, values(swaptotal) as swaptotal, values(swapfree) as swapfree by _time, OStype, host\
| fillnull value=0 Real_total_MB System_PCT Process_PCT memtotal buffers cached memfree Virtual_total_MB Virtual_free_MB swapcached swaptotal swapfree\
| eval mem_used_effective = case(OStype=="AIX", (Real_total_MB/100)*(System_PCT+Process_PCT), OStype=="Linux", ((memtotal-(buffers+cached))-memfree), OStype=="Solaris", memtotal-memfree)\
| eval swap_used_effective = case(OStype=="AIX", (Virtual_total_MB-Virtual_free_MB), OStype=="Linux", ((swaptotal-swapfree)-swapcached), OStype=="Solaris", (swaptotal-swapfree))\
| eval memtotal=if(OStype=="AIX", Real_total_MB, memtotal), cached=if(OStype=="AIX", (Real_total_MB/100)*FScache_PCT, cached), memfree=if(OStype=="AIX", memtotal-((Real_total_MB/100)*(System_PCT+Process_PCT+FScache_PCT)), memfree)
iseval = 0

# define for all OS memory usage per process (TOP)
[def_all_os_top_memory]
definition = `extract_metrics`\
| eval {metric}=value\
| stats values(ResSet) as ResSet, values(ResText) as ResText, values(ResData) as ResData, values(ResSize) as ResSize by _time, OStype, host, dimension_Command\
| fillnull value=0 ResSet ResText ResData ResSize\
| eval mem_usage_mb=case(match(OStype, "Linux"), ((ResSet)/1024), match(OStype, "AIX"), ((ResData+ResText)/1024), match(OStype, "Solaris"), (ResSize/1024) )
iseval = 0

# define for disk read xfer against diskbsize
[def_disk_read_xfer]
definition = `extract_metrics`\
| eval disk_read=case(match(metric_name, "diskread"), value), disk_size=case(match(metric_name, "diskbsize"), value)\
| stats values(disk_read) as disk_read values(disk_size) as disk_size by _time, dimension_device, host\
| eval disk_read_iops=(disk_read/disk_size)\
| stats sum(disk_read_iops) as disk_read_iops by _time, host
iseval = 0

# define for disk read xfer against diskbsize by device
[def_disk_read_xfer_by_device]
definition = `extract_metrics`\
| eval disk_read=case(match(metric_name, "diskread"), value), disk_size=case(match(metric_name, "diskbsize"), value)\
| stats values(disk_read) as disk_read values(disk_size) as disk_size by _time, dimension_device, host\
| eval disk_read_iops=(disk_read/disk_size)\
| stats sum(disk_read_iops) as disk_read_iops by _time, host, dimension_device
iseval = 0

# define for disk write xfer against diskbsize
[def_disk_write_xfer]
definition = `extract_metrics`\
| eval disk_write=case(match(metric_name, "diskwrite"), value), disk_size=case(match(metric_name, "diskbsize"), value)\
| stats values(disk_write) as disk_write values(disk_size) as disk_size by _time, dimension_device, host\
| eval disk_write_iops=(disk_write/disk_size)\
| stats sum(disk_write_iops) as disk_write_iops by _time, host
iseval = 0

# define for disk write xfer against diskbsize by device
[def_disk_write_xfer_by_device]
definition = `extract_metrics`\
| eval disk_write=case(match(metric_name, "diskwrite"), value), disk_size=case(match(metric_name, "diskbsize"), value)\
| stats values(disk_write) as disk_write values(disk_size) as disk_size by _time, dimension_device, host\
| eval disk_write_iops=(disk_write/disk_size)\
| stats sum(disk_write_iops) as disk_write_iops by _time, host, dimension_device
iseval = 0

# define for dg read xfer against dgsize
[def_dg_read_xfer]
definition = `extract_metrics("dgread dgsize")`\
| stats max(dgread) as disk_read_KB_per_sec max(dgsize) as disk_block_size_KB by _time, dimension_device, host\
| eval disk_read_iops=(disk_read_KB_per_sec/disk_block_size_KB)\
| stats sum(disk_read_iops) as disk_read_iops by _time, host
iseval = 0

# define for dg read xfer against dgsize by device
[def_dg_read_xfer_by_device]
definition = `extract_metrics("dgread dgsize")`\
| stats max(dgread) as disk_read_KB_per_sec max(dgsize) as disk_block_size_KB by _time, dimension_device, host\
| eval disk_read_iops=(disk_read_KB_per_sec/disk_block_size_KB)\
| stats sum(disk_read_iops) as disk_read_iops by _time, host, dimension_device
iseval = 0

# define for dg write xfer against dgsize
[def_dg_write_xfer]
definition = `extract_metrics("dgwrite dgsize")`\
| stats max(dgwrite) as disk_write_KB_per_sec max(dgsize) as disk_block_size_KB by _time, dimension_device, host\
| eval disk_write_iops=(disk_write_KB_per_sec/disk_block_size_KB)\
| stats sum(disk_write_iops) as disk_write_iops by _time, host
iseval = 0

# define for dg write xfer against dgsize by device
[def_dg_write_xfer_by_device]
definition = `extract_metrics("dgwrite dgsize")`\
| stats max(dgwrite) as disk_write_KB_per_sec max(dgsize) as disk_block_size_KB by _time, dimension_device, host\
| eval disk_write_iops=(disk_write_KB_per_sec/disk_block_size_KB)\
| stats sum(disk_write_iops) as disk_write_iops by _time, host, dimension_device
iseval = 0

#########################################
# frameID mapping
#########################################

[mapping_frameID]
definition = lookup nmon_frameID_mapping host as host OUTPUT frameID\
| eval frameID=if(isnull(frameID), host, frameID)
iseval = 0

#########################################
# mcatalog
#########################################

# used by the data dictionary explorer UI
[def_mcatalog_full]
definition = mcatalog values(_dims) where `nmon_metrics_index` metric_name="os.unix.nmon.*" by metric_name\
| fields metric_name | sort 0 metric_name\
| append [ | inputlookup nmon_metric_catalog | fields metric_name ]\
| rex field="metric_name" "os\.unix\.nmon\.(?<metric_category>\w*)\.(?<nmon_section>\w*)"\
| sort 0 metric_name\
| rex field="metric_name" "\.(?<metric>\w*)$"\
| fields metric_category,nmon_section,metric\
| search [ | mcatalog values(_dims) where `nmon_metrics_index` metric_name="os.unix.nmon.*" by metric_name\
| fields metric_name | sort 0 metric_name\
| rex field="metric_name" "os\.unix\.nmon\.(?<metric_category>\w*)\.(?<nmon_section>\w*)"\
| stats count by nmon_section | fields - count | fields nmon_section ]
iseval = 0

# mcatalog dictionary without dimensions
[def_mcatalog_dictionary(1)]
args = osfilter
definition = mcatalog values(sourcetype) as sourcetype_values where `nmon_metrics_index` metric_name=os.unix.nmon.* host=* OStype=$osfilter$ by OStype, metric_name\
| rename sourcetype_values as sourcetype\
| `extract_metrics`\
| rex field=metric_name "os\.unix\.nmon\.(?<metric_category>[^\.]*)\.(?<nmon_section>[^\.]*)"\
| stats count by metric_category, nmon_section, metric
iseval = 0

# mcatalog dictionary with dimensions
[def_mcatalog_dictionary_with_dimensions(1)]
args = osfilter
definition = mcatalog values(sourcetype) as sourcetype_values values(_dims) as dimensions where `nmon_metrics_index` metric_name=os.unix.nmon.* host=* OStype=$osfilter$ by OStype, metric_name\
| rename sourcetype_values as sourcetype\
| rex field="metric_name" ".(?<metric>[\w|\-|\_]*)$"\
| rex field=metric_name "os\.unix\.nmon\.(?<metric_category>[^\.]*)\.(?<nmon_section>[^\.]*)"\
| mvexpand dimensions\
| where (((dimensions == "OStype") OR (dimensions == "serialnum")) OR like(dimensions,"dimension_%"))\
| stats count by metric_category, nmon_section, metric, dimensions\
| eval dimensions=if(match(dimensions, "dimension_.*"), dimensions, "none")\
| dedup metric_category, nmon_section, metric, dimensions\
| eval dimensions=if(match(dimensions, "dimension_.*"), dimensions, ""), count=if(match(dimensions, "dimension_.*"), count,1)
iseval = 0

# mcatalog inventory output enriched with nmon inventory data
[def_mcatalog_mapped_nmon_inventory]
definition = mcatalog values(serialnum) as serials values(OStype) as OStype_values where `nmon_metrics_index` metric_name="os.unix.nmon.*" by host\
| rename serials as serialnum, OStype_values as OStype\
| `mapping_frameID`\
| lookup nmon_inventory hostname as host OUTPUT OSversion, cpu_cores, Physical_mem_MB, Virtual_mem_MB, uptime_duration, system_startup_date, reporting_date\
| eval OS_summary=upper(OStype)+" / "+OSversion\
| fields frameID, serialnum, host, OS_summary, cpu_cores, Physical_mem_MB, Virtual_mem_MB, uptime_duration, system_startup_date, reporting_date
iseval = 0

# mcatalog inventory mapped with main KPIs
[def_mcatalog_mapped_nmon_inventory_with_main_kpis]
definition = `def_mcatalog_mapped_nmon_inventory`\
| fields frameID,serialnum,host,OS_summary,cpu_cores,Physical_mem_MB,Virtual_mem_MB\
| rename Physical_mem_MB as "physical mem (MB)", Virtual_mem_MB as "virtual mem (MB)"\
| sort 0 host\
| appendcols\
[ | mstats avg(_value) as value where `nmon_metrics_index` `def_cpu_all_os_metric_filters` by metric_name, OStype, host span=1m\
| `def_all_os_cpu_load_percent`\
| stats avg(cpu_load_percent) AS avg_cpu_usage, sparkline(avg(cpu_load_percent),5m) As cpu_sparkline by host\
| sort 0 host ]\
| appendcols\
[ | mstats avg(_value) as value where `nmon_metrics_index` metric_name=os.unix.nmon.memory.mem.Real_total_MB\
OR metric_name=os.unix.nmon.memory.mem.Real_free_MB\
OR metric_name=os.unix.nmon.memory.mem.memtotal\
OR metric_name=os.unix.nmon.memory.mem.buffers\
OR metric_name=os.unix.nmon.memory.mem.cached\
OR metric_name=os.unix.nmon.memory.mem.memfree\
OR metric_name=os.unix.nmon.memory.mem.Virtual_total_MB\
OR metric_name=os.unix.nmon.memory.mem.Virtual_free_MB\
OR metric_name=os.unix.nmon.memory.mem.swapcached\
OR metric_name=os.unix.nmon.memory.mem.swaptotal\
OR metric_name=os.unix.nmon.memory.mem.swapfree by host, metric_name span=1m\
| `def_memory_load_percent`\
| stats avg(mem_used_effective_PCT) AS avg_physical_mem_usage, sparkline(avg(mem_used_effective_PCT),5m) As sparkline_physical_mem,\
avg(swap_used_effective_PCT) AS avg_virtual_mem_usage, sparkline(avg(swap_used_effective_PCT),5m) As sparkline_virtual_mem by host\
| sort 0 host ]\
| eval avg_cpu_usage=case(isnum(avg_cpu_usage), round(avg_cpu_usage, 2) . " %"),\
avg_physical_mem_usage=case(isnum(avg_physical_mem_usage), round(avg_physical_mem_usage, 2) . " %"),\
avg_virtual_mem_usage=if(isnum(avg_virtual_mem_usage), round(avg_virtual_mem_usage, 2) . " %", "no virtual memory")\
| `mapping_frameID`
iseval =0

#########################################
# df_storage specific
#########################################

# used by the configuration interface to provide server inventory
[def_filesystem_inventory]
definition = mstats latest(_value) as value where `nmon_metrics_index` metric_name=os.unix.nmon.storage.df_storage.Available OR metric_name=os.unix.nmon.storage.df_storage.Use_pct OR metric_name=os.unix.nmon.storage.df_storage.Used OR metric_name=os.unix.nmon.storage.df_storage.blocks by serialnum, host, metric_name, dimension_mount, dimension_filesystem\
| eval Available=case(metric_name=="os.unix.nmon.storage.df_storage.Available", value), Use_pct=case(metric_name=="os.unix.nmon.storage.df_storage.Use_pct", value), Used=case(metric_name=="os.unix.nmon.storage.df_storage.Used", value), blocks=case(metric_name=="os.unix.nmon.storage.df_storage.blocks", value)\
| stats last(Available) as Available, last(Use_pct) as Use_pct, last(Used) as Used, last(blocks) as blocks by serialnum, host, dimension_mount, dimension_filesystem\
| rename dimension_mount as mount, dimension_filesystem as filesystem\
| eval storage_free=blocks-Used, storage_free_percent=(100-Use_pct)\
| rename Use_pct as storage_used_percent, blocks as storage, Used as storage_used, Available as storage_free\
| foreach storage, storage_free, storage_used [ eval <<FIELD>> = round('<<FIELD>>'/1024/1024, 2) ]\
| foreach storage*percent [ eval <<FIELD>> = round('<<FIELD>>', 2) ]\
| rename storage as "storage (GB)", storage_free as "storage free (GB)", storage_used as "storage used (GB)", storage_free_percent as "storage free (%)", storage_used_percent as "storage used (%)"\
| eval UsedPct=if(isnum('storage used (%)'), 'storage used (%)', 0 )\
| `mapping_frameID`\
| fields frameID, serialnum, host, mount, filesystem, "storage (GB)", "storage free (GB)", "storage used (GB)", "storage free (%)", "storage used (%)", UsedPct | rename UsedPct as current_used_percent\
| foreach storage*%* current_used_percent [ eval <<FIELD>> = round('<<FIELD>>', 2) ] | where like(mount, "%")
iseval = 0

#########################################
#	LPAR Specific definitions
#########################################

[lpar_define_conso]
definition = eval lpar_ecconso=round(((EC_User_PCT+EC_Sys_PCT+EC_Wait_PCT+EC_Idle_PCT)*entitled/100),2)\
| eval lpar_ec_pct_conso=round((((EC_User_PCT+EC_Sys_PCT+EC_Wait_PCT+EC_Idle_PCT)*entitled)/virtualCPUs),2)\
| eval lpar_vpconso=round(((VP_User_PCT+VP_Sys_PCT+VP_Wait_PCT+VP_Idle_PCT)*virtualCPUs/100),2)\
| eval lpar_vp_pct_conso=round((VP_User_PCT+VP_Sys_PCT+VP_Wait_PCT+VP_Idle_PCT),2)\
| eval pool_conso=round((poolCPUs-PoolIdle),2)\
| eval pool_pct_conso=round(((poolCPUs-PoolIdle)*poolCPUs/100),2)
iseval = 0

#########################################
#	Custom Span Macro Definition
#########################################

#################
# CUSTOMIZATION:
#################


# If you want to set a minimal span feature that better fits your data, such as 5mn between 2 measures for example, please:
# - Copy the 2 customspan macros to your local/macros.conf
# - Edit the line:

#  | eval span=if(spanrestricted <= 20, "20s", span)\

# And replace with: (example with 5 minutes span, time unit is in seconds)

#  | eval span=if(spanrestricted <= (5*60), "5m", span)\

[nmon_span]
definition = [ | stats count | addinfo\
| eval earliest=if(info_min_time == "0.000", info_search_time,info_min_time)\
| eval latest=if(info_max_time == "+Infinity", info_search_time,info_max_time)\
| eval searchStartTIme=strftime(earliest,"%a %d %B %Y %H:%M")\
| eval searchEndTime=strftime(latest,"%a %d %B %Y %H:%M")\
| eval Difference = (latest - earliest)\
| eval span=case(\
info_min_time == "0.000", "2m",\
Difference > (3000*24*60*60),"4d",\
Difference > (2000*24*60*60),"3d",\
Difference > (1000*24*60*60),"2d",\
Difference > (500*24*60*60),"1d",\
Difference > (333*24*60*60),"12h",\
Difference > (166*24*60*60),"8h",\
Difference > (83*24*60*60),"4h",\
Difference > (41*24*60*60),"2h",\
Difference > (916*60*60),"1h",\
Difference > (833*60*60),"55m",\
Difference > (750*60*60),"50m",\
Difference > (666*60*60),"45m",\
Difference > (583*60*60),"40m",\
Difference > (500*60*60),"35m",\
Difference > (416*60*60),"30m",\
Difference > (333*60*60),"25m",\
Difference > (250*60*60),"20m",\
Difference > (166*60*60),"15m",\
Difference > (83*60*60),"10m",\
Difference > (66*60*60),"5m",\
Difference > (50*60*60),"4m",\
Difference > (33*60*60),"3m",\
Difference > (16*60*60),"2m",\
Difference > (8*60*60),"1m",\
Difference <= (8*60*60),"1m"\
)\
| eval spanrestricted=case(\
info_min_time == "0.000", 2*60,\
Difference > (916*60*60),60*60,\
Difference > (833*60*60),55*60,\
Difference > (750*60*60),50*60,\
Difference > (666*60*60),45*60,\
Difference > (583*60*60),40*60,\
Difference > (500*60*60),35*60,\
Difference > (416*60*60),30*60,\
Difference > (333*60*60),25*60,\
Difference > (250*60*60),20*60,\
Difference > (166*60*60),15*60,\
Difference > (83*60*60),10*60,\
Difference > (66*60*60),5*60,\
Difference > (50*60*60),4*60,\
Difference > (33*60*60),180,\
Difference > (16*60*60),120,\
Difference > (8*60*60),60,\
Difference <= (8*60*60),60\
)\
| eval span=case(spanrestricted < interval, interval, spanrestricted >= interval, span, isnull(interval), span)\
| eval span=if(spanrestricted <= 60, "1m", span)\
| return span ]
iseval = 0

# Baseline macro, uses a minimal span of 5m to match the Baseline span

[baseline_span]
definition = [ | stats count | addinfo\
| eval earliest=if(info_min_time == "0.000", info_search_time,info_min_time)\
| eval latest=if(info_max_time == "+Infinity", info_search_time,info_max_time)\
| eval searchStartTIme=strftime(earliest,"%a %d %B %Y %H:%M")\
| eval searchEndTime=strftime(latest,"%a %d %B %Y %H:%M")\
| eval Difference = (latest - earliest)\
| eval span=case(\
info_min_time == "0.000", "2m",\
Difference > (3000*24*60*60),"4d",\
Difference > (2000*24*60*60),"3d",\
Difference > (1000*24*60*60),"2d",\
Difference > (500*24*60*60),"1d",\
Difference > (333*24*60*60),"12h",\
Difference > (166*24*60*60),"8h",\
Difference > (83*24*60*60),"4h",\
Difference > (41*24*60*60),"2h",\
Difference > (916*60*60),"1h",\
Difference > (833*60*60),"55m",\
Difference > (750*60*60),"50m",\
Difference > (666*60*60),"45m",\
Difference > (583*60*60),"40m",\
Difference > (500*60*60),"35m",\
Difference > (416*60*60),"30m",\
Difference > (333*60*60),"25m",\
Difference > (250*60*60),"20m",\
Difference > (166*60*60),"15m",\
Difference > (83*60*60),"10m",\
Difference > (8*60*60),"5m",\
Difference <= (8*60*60),"5m"\
)\
| eval spanrestricted=case(\
info_min_time == "0.000", 2*60,\
Difference > (916*60*60),60*60,\
Difference > (833*60*60),55*60,\
Difference > (750*60*60),50*60,\
Difference > (666*60*60),45*60,\
Difference > (583*60*60),40*60,\
Difference > (500*60*60),35*60,\
Difference > (416*60*60),30*60,\
Difference > (333*60*60),25*60,\
Difference > (250*60*60),20*60,\
Difference > (166*60*60),15*60,\
Difference > (83*60*60),10*60,\
Difference > (8*60*60),5*60,\
Difference <= (8*60*60),5*60\
)\
| eval span=case(spanrestricted < interval, interval, spanrestricted >= interval, span, isnull(interval), span)\
| eval span=if(spanrestricted <= 60, "5m", span)\
| return span ]
iseval = 0

###############################################
#	Macro used in Compare interface
###############################################

[eval_compare]
definition = eval Evolution_usage=((usage_period2-usage_period1)/usage_period1)*100 | eval Evolution_usage=round(Evolution_usage,3)\
| eval Delta_usage=round((usage_period2-usage_period1),3)\
| eval Evolution_pct_usage=case(isnotnull(pct_usage_period1), ((pct_usage_period2-pct_usage_period1)/pct_usage_period1)*100 ) | eval Evolution_pct_usage=round(Evolution_pct_usage,3)\
| eval Delta_pct_usage=round((pct_usage_period2-pct_usage_period1),3)\
| fields host,usage_period1,usage_period2,Delta_usage,Evolution_usage,*\
| rename Evolution_usage As "Evolution_usage (%)"\
| rename Evolution_pct_usage As "Evolution_pct_usage (%)"\
| eval range=case(\
usage_period1==usage_period2, 0, usage_period1<usage_period2, 2, usage_period1>usage_period2, 4,\
pct_usage_period1==pct_usage_period2, 0, pct_usage_period1<pct_usage_period2, 2, pct_usage_period1>pct_usage_period2, 4)\
| rangemap field=range equal=0-1 increase=2-3 decrease=4-5 default=no\
| eval usage_period1=round(usage_period1,3)\
| eval usage_period2=round(usage_period2,3)
iseval = 0

###################################
# 	Index Statistics
###################################

[indexes_datestats]
definition = rest /services/data/indexes\
| table currentDBSizeMB minTime maxTime totalEventCount splunk_server title\
| rename title as index | search `nmon_index`\
| eval firstTime=round(strptime('minTime', "%Y-%m-%dT%H:%M:%S%z"),0)\
| eval lastTime=round(strptime('maxTime', "%Y-%m-%dT%H:%M:%S%z"),0)\
| stats min(firstTime) as firstTime, max(lastTime) as lastTime\
| eval "First Event"=strftime(firstTime,"%d/%m/%y-%H:%M")\
| eval "Last Event"=strftime(lastTime,"%d/%m/%y-%H:%M")
iseval = 0

#####################
# NMON CONFIG SECTION
#####################

# Rex common to all OS

[nmon_config_common_rex]
definition = rex "(?i),version,(?P<nmon_version>.+)"\
| rex "(?i),command,(?P<nmon_command>.+)"\
| rex "(?i),OS,(?P<OS>[^,]+)"\
| rex "AAA,cpus,(?P<cpu_cores_position1>\d+)"\
| rex "AAA,cpus,\d+,(?P<cpu_cores_position2>\d+)"
iseval = 0

# AIX Specific

[nmon_config_AIX_rex]
definition = rex "AAA,AIX,(?P<AIX_LEVEL>.+)"\
| rex "BBB.+,[0-9].+,lparstat.+,\"Online\sVirtual\sCPUs\s+\:\s(?P<AIX_virtualcpus>\d+)\""\
| rex "BBB.+,[0-9].+,online\sMemory,(?P<AIX_memory_MB>\d+)"\
| rex "BBB.+,[0-9].+,lsconf,\"\s+Total\sPaging\sSpace:\s(?P<AIX_pagingspace_MB>\d+)"\
| rex "BBB.+,[0-9].+,lsconf,\"Processor\sImplementation\sMode:\s(?P<AIX_processor_mode>.+\w)\""\
| rex "BBB.+,[0-9].+,lsconf,\"Processor\sClock\sSpeed:\s(?P<AIX_processor_clockspeed>.+\w)\""\
| rex "BBB.+,[0-9].+,lsconf,\"CPU\sType:\s(?P<AIX_cpu_type>.+\w)\""\
| rex "BBB.+,[0-9].+,lsconf,\"Kernel\sType:\s(?P<AIX_kernel_type>.+\w)\""\
| rex "BBB.+,[0-9].+,lsconf,\"Platform\sFirmware\slevel:\s(?P<AIX_plateform_firmware_level>.+\w)\""\
| rex "BBB.+,[0-9].+,lsconf,\"Machine\sSerial\sNumber:\s(?P<AIX_Machine_SerialNumber>.+)\""\
| rex "AAA,SerialNumber,(?P<AIX_alt_Machine_SerialNumber>\w+)"\
| eval AIX_Machine_SerialNumber=if(isnotnull(AIX_Machine_SerialNumber), AIX_Machine_SerialNumber, AIX_alt_Machine_SerialNumber)\
| rex "BBB.+,[0-9].+,lparstat.+,\"Shared\sPool\sID\s+\:\s(?P<AIX_PoolID>.+)\""\
| eval AIX_PoolID=if(AIX_PoolID=="-","N/A" ,AIX_PoolID)\
| rex "BBB.+,[0-9].+,lparstat.+,\"Maximum\sPhysical\sCPUs\sin\ssystem\s+\:\s(?P<AIX_system_installed_CPUs>.+)\""\
| rex "BBB.+,[0-9].+,lparstat.+,\"Active\sPhysical\sCPUs\sin\ssystem\s+\:\s(?P<AIX_system_active_CPUs>.+)\""\
| rex "BBB.+,[0-9].+,lparstat.+,\"Active\sCPUs\sin\sPool\s+\:\s(?P<AIX_PoolCPUs>.+)\""\
| eval AIX_PoolCPUs=if(AIX_PoolCPUs=="-","N/A" ,AIX_PoolCPUs)\
| rex "BBB.+,[0-9].+,lparstat.+,\"Entitled\sCapacity\s+\:\s(?P<AIX_entitled>.+)\""\
| rex "BBB.+,[0-9].+,lsconf,\"Processor\sType:\s(?P<AIX_processor>.+\w)\""\
| strcat AIX_virtualcpus " / " cpu_cores_position2 cpu_cores_combo\
| eval AIX_logicalcores=if(isnotnull(cpu_cores_position2), cpu_cores_position2, cpu_cores_position1)
iseval = 0

# Linux specific

[nmon_config_Linux_rex]
definition = rex "AAA,OS,Linux,(?P<Linux_LEVEL>.+)"\
| rex "BBB.+,[0-9].+cpuinfo,.+model\sname.+:\s+(?P<Linux_processor>.+)\""\
| rex "BBB.+,[0-9].+,.+etc+.release,\"(?P<Linux_distribution>.+)\""\
| rex "BBB.+,[0-9].+,lsb\_release,\"Release:\s+(?P<Linux_version>.+)\""\
| rex "BBB.+,[0-9].+,.proc.meminfo,\"MemTotal:\s+(?P<Linux_memory_kB>\d+)" | eval Linux_memory_MB=round(Linux_memory_kB/1024,0)\
| rex "BBB.+,[0-9].+,.proc.meminfo,\"SwapTotal:\s+(?P<Linux_swap_kB>\d+)" | eval Linux_swap_MB=round(Linux_swap_kB/1024,0)\
| rex "AAA,OS,Linux,(?P<Linux_kernelversion>\d+.\d+).+,#"\
| rex "AAA,OS,Linux,(?P<Linux_kernel>.+),#"\
| rex "AAA,OS,Linux,(?P<Linux_fullkernel>.+)"
iseval = 0

# Solaris specific

[nmon_config_Solaris_rex]
definition = rex "AAA,OS,Solaris,(?P<Solaris_LEVEL>.+)"\
| rex "AAA,OS,Solaris,.+,(?P<Solaris_kernel>.+),.+,.+"\
| rex "AAA,OS,Solaris,(?P<Solaris_sunOS_version>.+),.+,.+,.+"\
| rex "BBB.+,[0-9].+,.+etc+.release,\"\s+(?P<Solaris_version>.+)\""\
| rex "BBB.+,[0-9].+psrinfo\s\-pv,\"\s+(?P<Solaris_processor>.+\w)\""\
| rex "BBB.+,[0-9].+psrinfo\s\-pv,.+clock\s(?P<Solaris_processor_clockspeed>.+)\)\""
iseval = 0

###################################
# 	Final macros used for inventory data retrieve
###################################

[nmon_config]
definition = `nmon_index` sourcetype=nmon_config\
| rex "(?i),host,(?P<hostname>.+)"\
| `nmon_config_common_rex`\
| `nmon_config_AIX_rex`\
| `nmon_config_Linux_rex`\
| `nmon_config_Solaris_rex`\
| eval OStype=case(OS == "Linux", "Linux", OS == "Solaris", "Solaris", isnotnull(AIX_LEVEL), "AIX")\
| eval OS_Level=case(isnotnull(AIX_LEVEL), AIX_LEVEL, isnotnull(Solaris_version), Solaris_version, isnotnull(Linux_distribution), Linux_distribution)\
| eval cpu_cores=if(isnotnull(AIX_virtualcpus), cpu_cores_combo, cpu_cores_position1)\
| eval Processor=case(isnotnull(AIX_processor), AIX_processor, isnotnull(Solaris_processor), Solaris_processor, isnotnull(Linux_processor), Linux_processor)
iseval = 0

# Used in addition with the command: `nmon_index` sourcetype=nmon_config | rex "(?i),host,(?<hostname>.+)" | search $hostname$" in Nmon_Summary
# to optimize time treatment

[nmon_config_rex]
definition = `nmon_config_common_rex`\
| `nmon_config_AIX_rex`\
| `nmon_config_Linux_rex`\
| `nmon_config_Solaris_rex`\
| eval OStype=case(OS == "Linux", "Linux", OS == "Solaris", "Solaris", isnotnull(AIX_LEVEL), "AIX")\
| eval OS_Level=case(isnotnull(AIX_LEVEL), AIX_LEVEL, isnotnull(Solaris_version), Solaris_version, isnotnull(Linux_distribution), Linux_distribution)\
| eval cpu_cores=if(isnotnull(AIX_virtualcpus), cpu_cores_combo, cpu_cores_position1)\
| eval Processor=case(isnotnull(AIX_processor), AIX_processor, isnotnull(Solaris_processor), Solaris_processor, isnotnull(Linux_processor), Linux_processor)
iseval = 0

# Called by User Interfaces to filter OS list based on type of OS

[nmon_inventory]
definition = | inputlookup nmon_inventory
iseval = 0

# This macro will be called by the scheduled report responsible for the update of the configuration KVstore lookup
# On some large system at scale, the lengh of the code seemed to be an issue in Splunk Web

[nmon_inventory_update]
definition = tstats latest("Nmon_Config.OStype") as OStype\
latest("Nmon_Config.AIX_Machine_SerialNumber") AS AIX_Machine_SerialNumber\
latest("Nmon_Config.AIX_virtualcpus") AS AIX_virtualcpus\
latest("Nmon_Config.AIX_logicalcores") AS AIX_logicalcores\
latest("Nmon_Config.AIX_entitled") AS AIX_entitled\
latest("Nmon_Config.AIX_LEVEL") AS AIX_LEVEL\
latest("Nmon_Config.AIX_processor_mode") AS AIX_processor_mode\
latest("Nmon_Config.AIX_processor_clockspeed") AS AIX_processor_clockspeed\
latest("Nmon_Config.AIX_cpu_type") AS AIX_cpu_type\
latest("Nmon_Config.AIX_kernel_type") AS AIX_kernel_type\
latest("Nmon_Config.AIX_plateform_firmware_level") AS AIX_plateform_firmware_level\
latest("Nmon_Config.AIX_PoolID") AS AIX_PoolID\
latest("Nmon_Config.AIX_system_installed_CPUs") AS AIX_system_installed_CPUs\
latest("Nmon_Config.AIX_system_active_CPUs") AS AIX_system_active_CPUs\
latest("Nmon_Config.AIX_PoolCPUs") AS AIX_PoolCPUs\
latest("Nmon_Config.AIX_memory_MB") AS AIX_memory_MB\
latest("Nmon_Config.AIX_pagingspace_MB") AS AIX_pagingspace_MB\
latest("Nmon_Config.Linux_memory_MB") AS Linux_memory_MB\
latest("Nmon_Config.Linux_swap_MB") AS Linux_swap_MB\
latest("Nmon_Config.Linux_distribution") AS Linux_distribution\
latest("Nmon_Config.Linux_vendor") AS Linux_vendor\
latest("Nmon_Config.Linux_kernelversion") AS Linux_kernelversion\
latest("Nmon_Config.Solaris_version") AS Solaris_version\
latest("Nmon_Config.Solaris_sunOS_version") AS Solaris_sunOS_version\
latest("Nmon_Config.Solaris_processor_clockspeed") AS Solaris_processor_clockspeed\
latest("Nmon_Config.Solaris_physical_memory_MB") AS Solaris_physical_memory_MB\
latest("Nmon_Config.Processor") AS Processor\
latest("Nmon_Config.cpu_cores") AS cpu_cores\
latest("Nmon_Config.nmon_version") AS nmon_version\
latest("Nmon_Config.uptime") AS uptime_seconds\
latest("Nmon_Config.event_epoch") AS last_report\
from datamodel=metricator-nmon-config where (nodename = Nmon_Config) (sourcetype=nmon_config) by host prestats=true\
| tstats latest("Uptime.uptime") AS external_uptime latest(Uptime.event_epoch) as external_last_report from datamodel=metricator-nmon-config.Uptime where (nodename = Uptime) (Uptime.uptime = "*") by host append=true prestats=true\
| stats dedup_splitvals=t\
latest("Nmon_Config.OStype") as OStype\
latest("Nmon_Config.AIX_Machine_SerialNumber") AS AIX_Machine_SerialNumber\
latest("Nmon_Config.AIX_virtualcpus") AS AIX_virtualcpus\
latest("Nmon_Config.AIX_logicalcores") AS AIX_logicalcores\
latest("Nmon_Config.AIX_entitled") AS AIX_entitled\
latest("Nmon_Config.AIX_LEVEL") AS AIX_LEVEL\
latest("Nmon_Config.AIX_processor_mode") AS AIX_processor_mode\
latest("Nmon_Config.AIX_processor_clockspeed") AS AIX_processor_clockspeed\
latest("Nmon_Config.AIX_cpu_type") AS AIX_cpu_type\
latest("Nmon_Config.AIX_kernel_type") AS AIX_kernel_type\
latest("Nmon_Config.AIX_plateform_firmware_level") AS AIX_plateform_firmware_level\
latest("Nmon_Config.AIX_PoolID") AS AIX_PoolID\
latest("Nmon_Config.AIX_system_installed_CPUs") AS AIX_system_installed_CPUs\
latest("Nmon_Config.AIX_system_active_CPUs") AS AIX_system_active_CPUs\
latest("Nmon_Config.AIX_PoolCPUs") AS AIX_PoolCPUs\
latest("Nmon_Config.AIX_memory_MB") AS AIX_memory_MB\
latest("Nmon_Config.AIX_pagingspace_MB") AS AIX_pagingspace_MB\
latest("Nmon_Config.Linux_memory_MB") AS Linux_memory_MB\
latest("Nmon_Config.Linux_swap_MB") AS Linux_swap_MB\
latest("Nmon_Config.Linux_distribution") AS Linux_distribution\
latest("Nmon_Config.Linux_vendor") AS Linux_vendor\
latest("Nmon_Config.Linux_kernelversion") AS Linux_kernelversion\
latest("Nmon_Config.Solaris_version") AS Solaris_version\
latest("Nmon_Config.Solaris_sunOS_version") AS Solaris_sunOS_version\
latest("Nmon_Config.Solaris_processor_clockspeed") AS Solaris_processor_clockspeed\
latest("Nmon_Config.Solaris_physical_memory_MB") AS Solaris_physical_memory_MB\
latest("Nmon_Config.Processor") AS Processor\
latest("Nmon_Config.cpu_cores") AS cpu_cores\
latest("Nmon_Config.nmon_version") AS nmon_version\
latest("Nmon_Config.uptime") AS uptime_seconds\
latest("Uptime.uptime") AS external_uptime_seconds\
latest("Nmon_Config.event_epoch") AS last_report, latest(Uptime.event_epoch) as external_last_report by host\
| sort limit=0 host\
| rename host AS hostname\
| eval now=now()\
| eval uptime_seconds=if(isnotnull(external_uptime_seconds), external_uptime_seconds, uptime_seconds)\
| eval last_report=if(isnotnull(external_last_report), external_last_report, last_report)\
| fields - external_uptime_seconds\
| eval uptime_seconds=(uptime_seconds+(now-last_report))\
| eval uptime_duration=tostring(uptime_seconds, "duration")\
| fields - external_last_report\
| eval reporting_date=strftime(last_report, "%m/%d/%Y %H:%M")\
| eval system_startup_date=strftime((now()-uptime_seconds), "%m/%d/%Y %H:%M")\
| eval cpu_logicalcores=if(isnum(AIX_logicalcores), AIX_logicalcores, cpu_cores)\
| rex field=Linux_distribution mode=sed "s/Q$//g"\
| fields hostname, OStype, AIX_Machine_SerialNumber, AIX_virtualcpus, AIX_logicalcores, AIX_entitled, AIX_LEVEL,\
AIX_processor_mode, AIX_processor_clockspeed, AIX_cpu_type, AIX_kernel_type, AIX_plateform_firmware_level, AIX_PoolID,\
AIX_system_installed_CPUs, AIX_system_active_CPUs, AIX_PoolCPUs, AIX_memory_MB, AIX_pagingspace_MB, Linux_memory_MB, Linux_swap_MB, Linux_distribution,\
Linux_vendor, Linux_kernelversion, Solaris_version, Solaris_sunOS_version, Solaris_processor_clockspeed, Solaris_physical_memory_MB, Processor, cpu_cores, cpu_logicalcores, nmon_version, uptime_seconds, uptime_duration, system_startup_date, reporting_date\
| eval OSversion=case(OStype=="Linux", Linux_distribution, OStype=="AIX", AIX_LEVEL, OStype=="Solaris", if(isnotnull(Solaris_version), Solaris_version, Solaris_sunOS_version))\
| eval Physical_mem_MB=case(OStype=="Linux", Linux_memory_MB, OStype=="AIX", AIX_memory_MB, OStype=="Solaris", Solaris_physical_memory_MB)\
| eval Virtual_mem_MB=case(OStype=="Linux", Linux_swap_MB, OStype=="AIX", AIX_pagingspace_MB, OStype=="Solaris", "NA")\
| fillnull value="NA"
iseval = 0

###################################
# 	Custom Span definition for Application Statistics Django View
###################################

[internal_table_stats_span]
definition = [ search index=_internal | head 1 | addinfo\
| eval earliest=if(info_min_time == "0.000", info_search_time,info_min_time)\
| eval latest=if(info_max_time == "+Infinity", info_search_time,info_max_time)\
| eval searchStartTIme=strftime(earliest,"%a %d %B %Y %H:%M")\
| eval searchEndTime=strftime(latest,"%a %d %B %Y %H:%M")\
| eval Difference = (latest - earliest)\
| eval span=case(\
Difference > (12*31*24*60*60),"1y",\
Difference > (31*24*60*60),"1m",\
Difference > (24*60*60),"1d",\
Difference <= (24*60*60),"1h"\
)\
| return span ]
iseval = 0

#####################
#	FILTER TIME		#
#####################

[No_Filter]
definition = eval time_filtering="false"
iseval = 0

[Day_BusinessDays_8h-19h]
definition = eval local_time=strftime(_time, "%H:%M"), date_wday=lower(strftime(_time, "%A")) | search (local_time>="08:00" AND local_time<="19:00") AND (date_wday!="sunday" date_wday!="saturday")
iseval = 0

[Day_WeekEnd_8h-19h]
definition = eval local_time=strftime(_time, "%H:%M"), date_wday=lower(strftime(_time, "%A")) | search (local_time>="08:00" AND local_time<="19:00") AND (date_wday="sunday" OR date_wday="saturday")
iseval = 0

[Day_AllDays_8h-19h]
definition = eval local_time=strftime(_time, "%H:%M"), date_wday=lower(strftime(_time, "%A")) | search (local_time>="08:00" AND local_time<="19:00")
iseval = 0

[Night_BusinessDays_19h-8h]
definition = eval local_time=strftime(_time, "%H:%M"), date_wday=lower(strftime(_time, "%A")) | search (local_time>="19:00" AND local_time<="23:59") OR (local_time>="00:00" AND local_time<="08:00") AND (date_wday!="sunday" date_wday!="saturday")
iseval = 0

[Night_WeekEnd_19h-8h]
definition = eval local_time=strftime(_time, "%H:%M"), date_wday=lower(strftime(_time, "%A")) | search (local_time>="19:00" AND local_time<="23:59") OR (local_time>="00:00" AND local_time<="08:00") AND (date_wday="sunday" OR date_wday="saturday")
iseval = 0

[Night_AllDays_19h-8h]
definition = eval local_time=strftime(_time, "%H:%M"), date_wday=lower(strftime(_time, "%A")) | search (local_time>="19:00" AND local_time<="23:59") OR (local_time>="00:00" AND local_time<="08:00")
iseval = 0

####################################################
# NMON PROCESSING SECTION
####################################################

[nmon_processing]
definition = `nmon_index` sourcetype=nmon_processing
iseval = 0

[nmon_processing_stats]
definition = `nmon_processing`\
| eval size_KB=round((size_in_bytes/1000),2)\
| eval size_MB=round((size_in_bytes/1000/1000),2)\
| stats\
min(nbr_lines) As min_nbr_lines, avg(nbr_lines) As avg_nbr_lines, max(nbr_lines) As max_nbr_lines, sum(nbr_lines) As sum_nbr_lines,\
min(size_KB) As min_size_KB, avg(size_KB) As avg_size_KB, max(size_KB) As max_size_KB, sum(size_KB) As sum_size_KB,\
min(size_MB) As min_size_MB, avg(size_MB) As avg_size_MB, max(size_MB) As max_size_MB, sum(size_MB) As sum_size_MB,\
min(elapsed_in_seconds) As min_elapsed_in_seconds, avg(elapsed_in_seconds) As avg_elapsed_in_seconds, max(elapsed_in_seconds) As max_elapsed_in_seconds, sum(elapsed_in_seconds) As sum_elapsed_in_seconds\
| eval sum_nbr_lines_in_millions=round((sum_nbr_lines/1000/1000),2)\
| eval sum_size_GB=round((sum_size_KB/1000/1000),2)\
| eval sum_elapsed=tostring(sum_elapsed_in_seconds,"duration")\
| eval avg_nbr_lines=round(avg_nbr_lines,0)\
| eval avg_size_MB=round(avg_size_MB,2)\
| eval avg_elapsed_in_seconds=round(avg_elapsed_in_seconds,2)
iseval = 0

[nmon_processing_stats_by_time]
definition = `nmon_processing`\
| eval size_KB=round((size_in_bytes/1000),2)\
| eval size_MB=round((size_in_bytes/1000/1000),2)\
| stats\
min(nbr_lines) As min_nbr_lines, avg(nbr_lines) As avg_nbr_lines, max(nbr_lines) As max_nbr_lines, sum(nbr_lines) As sum_nbr_lines,\
min(size_KB) As min_size_KB, avg(size_KB) As avg_size_KB, max(size_KB) As max_size_KB, sum(size_KB) As sum_size_KB,\
min(size_MB) As min_size_MB, avg(size_MB) As avg_size_MB, max(size_MB) As max_size_MB, sum(size_MB) As sum_size_MB,\
min(elapsed_in_seconds) As min_elapsed_in_seconds, avg(elapsed_in_seconds) As avg_elapsed_in_seconds, max(elapsed_in_seconds) As max_elapsed_in_seconds, sum(elapsed_in_seconds) As sum_elapsed_in_seconds by _time\
| eval sum_nbr_lines_in_millions=round((sum_nbr_lines/1000/1000),2)\
| eval sum_size_GB=round((sum_size_KB/1000/1000),2)\
| eval avg_nbr_lines=round(avg_nbr_lines,0)\
| eval avg_size_MB=round(avg_size_MB,2)\
| eval avg_elapsed_in_seconds=round(avg_elapsed_in_seconds,2)
iseval = 0

###################
# ALERTING MACROS #
###################

[alerting_cpu_usage]
definition = mstats avg(_value) as value where `nmon_metrics_index` (metric_name=os.unix.nmon.cpu.cpu_all.Sys_PCT OR metric_name=os.unix.nmon.cpu.cpu_all.User_PCT OR metric_name=os.unix.nmon.cpu.cpu_all.Wait_PCT OR metric_name=os.unix.nmon.cpu.cpu_all.Steal_PCT OR metric_name=os.unix.nmon.cpu.lpar.VP_User_PCT OR metric_name=os.unix.nmon.cpu.lpar.VP_Sys_PCT OR metric_name=os.unix.nmon.cpu.lpar.VP_Wait_PCT OR metric_name=os.unix.nmon.cpu.lpar.VP_Idle_PCT OR metric_name=os.unix.nmon.cpu.lpar.PhysicalCPU OR metric_name=os.unix.nmon.cpu.lpar.virtualCPUs OR metric_name=os.unix.nmon.cpu.lpar.partition_active_processors) by metric_name, OStype, host span=1m\
| `def_all_os_cpu_load_percent`\
| fields _time, host, cpu_load_percent\
| `mapping_frameID`\
| lookup nmon_alerting_threshold_template frameID OUTPUT alert_cpu_max_percent as template_alert_cpu_max_percent, alert_cpu_min_time_seconds as template_alert_cpu_min_time_seconds\
| lookup nmon_alerting_threshold frameID host OUTPUT alert_cpu_max_percent as server_alert_cpu_max_percent, alert_cpu_min_time_seconds as server_alert_cpu_min_time_seconds\
| eval default_alert_cpu_max_percent="90", default_alert_cpu_min_time_seconds="300"\
| eval alert_cpu_max_percent=case(isnum(server_alert_cpu_max_percent), server_alert_cpu_max_percent, isnum(template_alert_cpu_max_percent), template_alert_cpu_max_percent, isnum(default_alert_cpu_max_percent), default_alert_cpu_max_percent),\
alert_cpu_min_time_seconds=case(isnum(server_alert_cpu_min_time_seconds), server_alert_cpu_min_time_seconds, isnum(template_alert_cpu_min_time_seconds), template_alert_cpu_min_time_seconds, isnum(default_alert_cpu_min_time_seconds), default_alert_cpu_min_time_seconds),\
alert_threshold_source=case(isnum(server_alert_cpu_max_percent), "server_thresholds", isnum(template_alert_cpu_max_percent), "template_thresholds", isnum(default_alert_cpu_max_percent), "default_threshold")\
| sort 0 - _time\
| eval status=if(cpu_load_percent>alert_cpu_max_percent, "red", "green")\
| eval {status}=status\
| transaction frameID host status keepevicted=t keeporphans=t maxpause=5m\
| stats max(_time) as _time, latest(duration) as duration, latest(cpu_load_percent) as latest_cpu_load_percent, latest(alert_cpu_max_percent) as alert_cpu_max_percent, latest(alert_cpu_min_time_seconds) as alert_cpu_min_time_seconds, latest(alert_threshold_source) as alert_threshold_source, latest(status) as status by frameID, host\
| eval "duration (hh:mm:ss)"=tostring(duration, "duration")\
| where (status="red") AND (duration>=alert_cpu_min_time_seconds)\
| fields frameID,host,_time,duration,"duration (hh:mm:ss)",latest_cpu_load_percent,alert_cpu_max_percent,alert_cpu_min_time_seconds,alert_threshold_source
iseval = 0

[alerting_filesystem_usage]
definition = mstats avg(_value) as value where `nmon_metrics_index` (metric_name="os.unix.nmon.storage.df_storage.Use_pct" OR metric_name="os.unix.nmon.storage.jfsfile") by host, metric_name, dimension_mount span=1m\
| eval df_storage_value=case((metric_name == "os.unix.nmon.storage.df_storage.Use_pct"),value), jfsfile_value=case((metric_name == "os.unix.nmon.storage.jfsfile"),value), storage_used_percent=if(isnum(df_storage_value),df_storage_value,jfsfile_value)\
| stats latest(storage_used_percent) as storage_used_percent by _time, host, dimension_mount\
| rename dimension_mount as mount\
| `mapping_frameID`\
| lookup nmon_alerting_threshold_template_filesystem frameID mount OUTPUT alert_fs_max_percent as template_alert_fs_max_percent, alert_fs_min_time_seconds as template_alert_fs_min_time_seconds, is_shared, _key as fs_uuid\
| lookup nmon_alerting_threshold_filesystem frameID host mount OUTPUT alert_fs_max_percent as server_alert_fs_max_percent, alert_fs_min_time_seconds as server_alert_fs_min_time_seconds\
| eval is_shared=if(isnull(is_shared), "False", is_shared)\
| eval fs_uuid=if(is_shared="True", fs_uuid, md5(frameID . ":" . host . ":" . mount))\
| eval default_alert_fs_max_percent="90", default_alert_fs_min_time_seconds="300"\
| eval alert_fs_max_percent=case(isnum(server_alert_fs_max_percent), server_alert_fs_max_percent, isnum(template_alert_fs_max_percent), template_alert_fs_max_percent, isnum(default_alert_fs_max_percent), default_alert_fs_max_percent),\
alert_fs_min_time_seconds=case(isnum(server_alert_fs_min_time_seconds), server_alert_fs_min_time_seconds, isnum(template_alert_fs_min_time_seconds), template_alert_fs_min_time_seconds, isnum(default_alert_fs_min_time_seconds), default_alert_fs_min_time_seconds),\
alert_threshold_source=case(isnum(server_alert_fs_max_percent), "server_thresholds", isnum(template_alert_fs_max_percent), "template_thresholds", isnum(default_alert_fs_max_percent), "default_threshold")\
| lookup nmon_alerting_filesystem_global_exclusion mount OUTPUT exclude as global_exclude\
| lookup nmon_alerting_filesystem_template_exclusion frameID mount OUTPUT exclude as template_exclude\
| lookup nmon_alerting_filesystem_per_server_exclusion host mount OUTPUT exclude as host_exclude\
| fillnull value="false" global_exclude template_exclude host_exclude\
| where (global_exclude!="true" AND template_exclude!="true" AND host_exclude!="true")\
| sort 0 - _time\
| eval status=if(storage_used_percent>alert_fs_max_percent, "red", "green")\
| eval {status}=status\
| transaction fs_uuid status keepevicted=t keeporphans=t maxpause=5m\
| stats first(frameID) as frameID, first(host) as host, first(mount) as mount, max(_time) as _time, latest(duration) as duration, latest(storage_used_percent) as latest_storage_used_percent, latest(alert_fs_max_percent) as alert_fs_max_percent, latest(alert_fs_min_time_seconds) as alert_fs_min_time_seconds, latest(alert_threshold_source) as alert_threshold_source, latest(status) as status by fs_uuid\
| eval "duration (hh:mm:ss)"=tostring(duration, "duration")\
| where (status="red") AND (duration>=alert_fs_min_time_seconds)\
| fields frameID,host,_time,mount,fs_uuid,duration,"duration (hh:mm:ss)",latest_storage_used_percent,alert_fs_max_percent,alert_fs_min_time_seconds,alert_threshold_source
iseval = 0

[alerting_realmemory_usage]
definition = mstats avg(_value) as value where `nmon_metrics_index` metric_name=os.unix.nmon.memory.memnew.System_PCT OR metric_name=os.unix.nmon.memory.memnew.Process_PCT OR metric_name=os.unix.nmon.memory.mem.memtotal OR metric_name=os.unix.nmon.memory.mem.buffers OR metric_name=os.unix.nmon.memory.mem.cached OR metric_name=os.unix.nmon.memory.mem.memfree by OStype, host, metric_name span=1m\
| `def_memory_load_percent`\
| fields _time, host,mem_used_effective_PCT\
| `mapping_frameID`\
| lookup nmon_alerting_threshold_template frameID OUTPUT alert_physical_memory_max_percent as template_alert_physical_memory_max_percent, alert_physical_memory_min_time_seconds as template_alert_physical_memory_min_time_seconds\
| lookup nmon_alerting_threshold frameID host OUTPUT alert_physical_memory_max_percent as server_alert_physical_memory_max_percent, alert_physical_memory_min_time_seconds as server_alert_physical_memory_min_time_seconds\
| eval default_alert_physical_memory_max_percent="90", default_alert_physical_memory_min_time_seconds="300"\
| eval alert_physical_memory_max_percent=case(isnum(server_alert_physical_memory_max_percent), server_alert_physical_memory_max_percent, isnum(template_alert_physical_memory_max_percent), template_alert_physical_memory_max_percent, isnum(default_alert_physical_memory_max_percent), default_alert_physical_memory_max_percent),\
alert_physical_memory_min_time_seconds=case(isnum(server_alert_physical_memory_min_time_seconds), server_alert_physical_memory_min_time_seconds, isnum(template_alert_physical_memory_min_time_seconds), template_alert_physical_memory_min_time_seconds, isnum(default_alert_physical_memory_min_time_seconds), default_alert_physical_memory_min_time_seconds),\
alert_threshold_source=case(isnum(server_alert_physical_memory_max_percent), "server_thresholds", isnum(template_alert_physical_memory_max_percent), "template_thresholds", isnum(default_alert_physical_memory_max_percent), "default_threshold")\
| sort 0 - _time\
| eval status=if(mem_used_effective_PCT>alert_physical_memory_max_percent, "red", "green")\
| eval {status}=status\
| transaction frameID host status keepevicted=t keeporphans=t maxpause=5m\
| stats max(_time) as _time, latest(duration) as duration, latest(mem_used_effective_PCT) as latest_mem_used_effective_PCT, latest(alert_physical_memory_max_percent) as alert_physical_memory_max_percent, latest(alert_physical_memory_min_time_seconds) as alert_physical_memory_min_time_seconds, latest(alert_threshold_source) as alert_threshold_source, latest(status) as status by frameID, host\
| eval "duration (hh:mm:ss)"=tostring(duration, "duration")\
| where (status="red") AND (duration>=alert_physical_memory_min_time_seconds)\
| fields frameID,host,_time,duration,"duration (hh:mm:ss)",latest_mem_used_effective_PCT,alert_physical_memory_max_percent,alert_physical_memory_min_time_seconds,alert_threshold_source
iseval = 0

[alerting_virtualmemory_usage]
definition = mstats avg(_value) as value where `nmon_metrics_index` metric_name=os.unix.nmon.memory.mem.Virtual_total_MB OR metric_name=os.unix.nmon.memory.mem.Virtual_free_MB OR metric_name=os.unix.nmon.memory.mem.swapcached OR metric_name=os.unix.nmon.memory.mem.swaptotal OR metric_name=os.unix.nmon.memory.mem.swapfree by OStype, host, metric_name span=1m\
| `def_memory_load_percent`\
| fields _time, host,swap_used_effective_PCT\
| `mapping_frameID`\
| lookup nmon_alerting_threshold_template frameID OUTPUT alert_virtual_memory_max_percent as template_alert_virtual_memory_max_percent, alert_virtual_memory_min_time_seconds as template_alert_virtual_memory_min_time_seconds\
| lookup nmon_alerting_threshold frameID host OUTPUT alert_virtual_memory_max_percent as server_alert_virtual_memory_max_percent, alert_virtual_memory_min_time_seconds as server_alert_virtual_memory_min_time_seconds\
| eval default_alert_virtual_memory_max_percent="40", default_alert_virtual_memory_min_time_seconds="300"\
| eval alert_virtual_memory_max_percent=case(isnum(server_alert_virtual_memory_max_percent), server_alert_virtual_memory_max_percent, isnum(template_alert_virtual_memory_max_percent), template_alert_virtual_memory_max_percent, isnum(default_alert_virtual_memory_max_percent), default_alert_virtual_memory_max_percent),\
alert_virtual_memory_min_time_seconds=case(isnum(server_alert_virtual_memory_min_time_seconds), server_alert_virtual_memory_min_time_seconds, isnum(template_alert_virtual_memory_min_time_seconds), template_alert_virtual_memory_min_time_seconds, isnum(default_alert_virtual_memory_min_time_seconds), default_alert_virtual_memory_min_time_seconds),\
alert_threshold_source=case(isnum(server_alert_virtual_memory_max_percent), "server_thresholds", isnum(template_alert_virtual_memory_max_percent), "template_thresholds", isnum(default_alert_virtual_memory_max_percent), "default_threshold")\
| sort 0 - _time\
| eval status=if(swap_used_effective_PCT>alert_virtual_memory_max_percent, "red", "green")\
| eval {status}=status\
| transaction frameID host status keepevicted=t keeporphans=t maxpause=5m\
| stats max(_time) as _time, latest(duration) as duration, latest(swap_used_effective_PCT) as latest_swap_used_effective_PCT, latest(alert_virtual_memory_max_percent) as alert_virtual_memory_max_percent, latest(alert_virtual_memory_min_time_seconds) as alert_virtual_memory_min_time_seconds, latest(alert_threshold_source) as alert_threshold_source, latest(status) as status by frameID, host\
| eval "duration (hh:mm:ss)"=tostring(duration, "duration")\
| where (status="red") AND (duration>=alert_virtual_memory_min_time_seconds)\
| fields frameID,host,_time,duration,"duration (hh:mm:ss)",latest_swap_used_effective_PCT,alert_virtual_memory_max_percent,alert_virtual_memory_min_time_seconds,alert_threshold_source
iseval = 0

###################
# BASELINE MACROS #
###################

### Baseline generation macros ###

#
# CPU_ALL
# Average CPU usage, relevant for ALL OS
#

# CPU usage with simple baseline able to chart in the future - future charting capable
[nmon_cpu_pct_simple_baseline_future(2)]
args= host,statsmode
definition = mstats avg(_value) as value where `nmon_metrics_index` metric_name=os.unix.nmon.cpu.cpu_all.Sys_PCT OR metric_name=os.unix.nmon.cpu.cpu_all.User_PCT OR metric_name=os.unix.nmon.cpu.cpu_all.Wait_PCT OR metric_name=os.unix.nmon.cpu.cpu_all.Steal_PCT host=$host$  by metric_name, host span=5m\
| `def_cpu_load_percent`\
| rename host AS hostname\
| append [ | gentimes [| stats count | addinfo | eval start=strftime('info_min_time', "%m/%d/%Y:%H:%M:%S") | return start] [| stats count | addinfo | eval end=strftime('info_max_time', "%m/%d/%Y:%H:%M:%S")\
| return end] increment=5m | eval _time=starttime | eval hostname="$host$"\
| timechart span=5m count by hostname | untable _time hostname count | fields - count ]\
| eval date_wday=if(isnull(date_wday), lower(strftime('_time', "%A")), date_wday)\
| eval local_time=if(isnull(local_time), strftime('_time', "%H%M"), local_time)\
| lookup nmon_baseline_CPU_ALL date_wday,local_time,hostname\
| timechart `baseline_span` $statsmode$(cpu_load_percent) AS cpu_load_percent, avg(baseline_avg_cpu) AS baseline_avg_cpu
iseval = 0

# CPU usage with simple baseline able to chart in the future - no future charting
[nmon_cpu_pct_simple_baseline(2)]
args= host,statsmode
definition = mstats avg(_value) as value where `nmon_metrics_index` metric_name=os.unix.nmon.cpu.cpu_all.Sys_PCT OR metric_name=os.unix.nmon.cpu.cpu_all.User_PCT OR metric_name=os.unix.nmon.cpu.cpu_all.Wait_PCT OR metric_name=os.unix.nmon.cpu.cpu_all.Steal_PCT host=$host$  by metric_name, host span=5m\
| `def_cpu_load_percent`\
| rename host AS hostname\
| eval date_wday=if(isnull(date_wday), lower(strftime('_time', "%A")), date_wday)\
| eval local_time=if(isnull(local_time), strftime('_time', "%H%M"), local_time)\
| lookup nmon_baseline_CPU_ALL date_wday,local_time,hostname\
| timechart `baseline_span` $statsmode$(cpu_load_percent) AS cpu_load_percent, avg(baseline_avg_cpu) AS baseline_avg_cpu
iseval = 0

# CPU usage with lower, average and upper baseline (predict command rendering) - future charting capable
[nmon_cpu_pct_full_baseline_future(2)]
args= host,statsmode
definition = mstats avg(_value) as value where `nmon_metrics_index` metric_name=os.unix.nmon.cpu.cpu_all.Sys_PCT OR metric_name=os.unix.nmon.cpu.cpu_all.User_PCT OR metric_name=os.unix.nmon.cpu.cpu_all.Wait_PCT OR metric_name=os.unix.nmon.cpu.cpu_all.Steal_PCT host=$host$  by metric_name, host span=5m\
| `def_cpu_load_percent`\
| rename host AS hostname\
| append [ | gentimes [| stats count | addinfo | eval start=strftime('info_min_time', "%m/%d/%Y:%H:%M:%S") | return start] [| stats count | addinfo | eval end=strftime('info_max_time', "%m/%d/%Y:%H:%M:%S")\
| return end] increment=5m | eval _time=starttime | eval hostname="$host$"\
| timechart span=5m count by hostname | untable _time hostname count | fields - count ]\
| eval date_wday=if(isnull(date_wday), lower(strftime('_time', "%A")), date_wday)\
| eval local_time=if(isnull(local_time), strftime('_time', "%H%M"), local_time)\
| lookup nmon_baseline_CPU_ALL date_wday,local_time,hostname\
| timechart `baseline_span` $statsmode$(cpu_load_percent) AS cpu_load_percent, avg(lower_baseline_avg_cpu) AS lower, avg(baseline_avg_cpu) AS predicted, avg(upper_baseline_avg_cpu) AS upper\
| eval _lower = "lower" | eval _predicted = "predicted" | eval _upper = "upper"
iseval = 0

# CPU usage with lower, average and upper baseline (predict command rendering) - no future charting
[nmon_cpu_pct_full_baseline(2)]
args= host,statsmode
definition = mstats avg(_value) as value where `nmon_metrics_index` metric_name=os.unix.nmon.cpu.cpu_all.Sys_PCT OR metric_name=os.unix.nmon.cpu.cpu_all.User_PCT OR metric_name=os.unix.nmon.cpu.cpu_all.Wait_PCT OR metric_name=os.unix.nmon.cpu.cpu_all.Steal_PCT host=$host$  by metric_name, host span=5m\
| `def_cpu_load_percent`\
| rename host AS hostname\
| eval date_wday=if(isnull(date_wday), lower(strftime('_time', "%A")), date_wday)\
| eval local_time=if(isnull(local_time), strftime('_time', "%H%M"), local_time)\
| lookup nmon_baseline_CPU_ALL date_wday,local_time,hostname\
| timechart `baseline_span` $statsmode$(cpu_load_percent) AS cpu_load_percent, avg(lower_baseline_avg_cpu) AS lower, avg(baseline_avg_cpu) AS predicted, avg(upper_baseline_avg_cpu) AS upper\
| eval _lower = "lower" | eval _predicted = "predicted" | eval _upper = "upper"
iseval = 0

#
# LPAR
# Average AIX micro-partitions Virtual CPU usage, relevant for AIX OS only
#

# Virtual CPU usage with simple baseline - future charting capable
[nmon_vp_usage_simple_baseline_future(2)]
args= host,statsmode
definition = mstats avg(_value) as value where `nmon_metrics_index` metric_name=os.unix.nmon.cpu.lpar.* host=$host$ by OStype, metric_name, host span=5m\
| `def_lpar_load_cores`\
| fields _time, host, lpar_load_cores, entitled, virtualCPUs\
| rename host AS hostname\
| append [ | gentimes [| stats count | addinfo | eval start=strftime('info_min_time', "%m/%d/%Y:%H:%M:%S") | return start] [| stats count | addinfo | eval end=strftime('info_max_time', "%m/%d/%Y:%H:%M:%S")\
| return end] increment=5m | eval _time=starttime | eval hostname="$host$"\
| timechart span=5m count by hostname | untable _time hostname count | fields - count ]\
| eval date_wday=if(isnull(date_wday), lower(strftime('_time', "%A")), date_wday)\
| eval local_time=if(isnull(local_time), strftime('_time', "%H%M"), local_time)\
| lookup nmon_baseline_LPAR date_wday,local_time,hostname\
| timechart `baseline_span` $statsmode$(lpar_load_cores) AS vp_usage, max(entitled) AS entitled, max(virtualCPUs) AS virtualCPUs, avg(baseline_avg_vp_usage) AS baseline_avg_vp_usage
iseval = 0

# Virtual CPU usage with simple baseline - no future charting
[nmon_vp_usage_simple_baseline(2)]
args= host,statsmode
definition = mstats avg(_value) as value where `nmon_metrics_index` metric_name=os.unix.nmon.cpu.lpar.* host=$host$ by OStype, metric_name, host span=5m\
| `def_lpar_load_cores`\
| fields _time, host, lpar_load_cores, entitled, virtualCPUs\
| rename host AS hostname\
| eval date_wday=if(isnull(date_wday), lower(strftime('_time', "%A")), date_wday)\
| eval local_time=if(isnull(local_time), strftime('_time', "%H%M"), local_time)\
| lookup nmon_baseline_LPAR date_wday,local_time,hostname\
| timechart `baseline_span` $statsmode$(lpar_load_cores) AS vp_usage, max(entitled) AS entitled, max(virtualCPUs) AS virtualCPUs, avg(baseline_avg_vp_usage) AS baseline_avg_vp_usage
iseval = 0

# Virtual CPU usage with lower, average and upper baseline (predict command rendering) - future charting capable
[nmon_vp_usage_full_baseline_future(2)]
args= host,statsmode
definition = mstats avg(_value) as value where `nmon_metrics_index` metric_name=os.unix.nmon.cpu.lpar.* host=$host$ by OStype, metric_name, host span=5m\
| `def_lpar_load_cores`\
| fields _time, host, lpar_load_cores, entitled, virtualCPUs\
| rename host AS hostname\
| append [ | gentimes [| stats count | addinfo | eval start=strftime('info_min_time', "%m/%d/%Y:%H:%M:%S") | return start] [| stats count | addinfo | eval end=strftime('info_max_time', "%m/%d/%Y:%H:%M:%S")\
| return end] increment=5m | eval _time=starttime | eval hostname="$host$"\
| timechart span=5m count by hostname | untable _time hostname count | fields - count ]\
| eval date_wday=if(isnull(date_wday), lower(strftime('_time', "%A")), date_wday)\
| eval local_time=if(isnull(local_time), strftime('_time', "%H%M"), local_time)\
| lookup nmon_baseline_LPAR date_wday,local_time,hostname\
| timechart `baseline_span` $statsmode$(lpar_load_cores) AS vp_usage, max(entitled) AS entitled, max(virtualCPUs) AS virtualCPUs\
avg(lower_baseline_avg_vp_usage) AS lower, avg(baseline_avg_vp_usage) AS predicted, avg(upper_baseline_avg_vp_usage) AS upper\
| eval _lower = "lower" | eval _predicted = "predicted" | eval _upper = "upper"
iseval = 0

# Virtual CPU usage with lower, average and upper baseline (predict command rendering) - no future charting
[nmon_vp_usage_full_baseline(2)]
args= host,statsmode
definition = mstats avg(_value) as value where `nmon_metrics_index` metric_name=os.unix.nmon.cpu.lpar.* host=$host$ by OStype, metric_name, host span=5m\
| `def_lpar_load_cores`\
| fields _time, host, lpar_load_cores, entitled, virtualCPUs\
| rename host AS hostname\
| eval date_wday=if(isnull(date_wday), lower(strftime('_time', "%A")), date_wday)\
| eval local_time=if(isnull(local_time), strftime('_time', "%H%M"), local_time)\
| lookup nmon_baseline_LPAR date_wday,local_time,hostname\
| timechart `baseline_span` $statsmode$(lpar_load_cores) AS vp_usage, max(entitled) AS entitled, max(virtualCPUs) AS virtualCPUs\
avg(lower_baseline_avg_vp_usage) AS lower, avg(baseline_avg_vp_usage) AS predicted, avg(upper_baseline_avg_vp_usage) AS upper\
| eval _lower = "lower" | eval _predicted = "predicted" | eval _upper = "upper"
iseval = 0

# Pool Virtual CPU usage with simple baseline - future charting capable
[nmon_pool_usage_simple_baseline_future(2)]
args= host,statsmode
definition = mstats avg(_value) as value where `nmon_metrics_index` metric_name=os.unix.nmon.cpu.lpar.* host="$host$" by OStype, metric_name, host span=5m\
| `def_all_os_lpar_pool_load_cores`\
| rename host AS hostname\
| append [ | gentimes [| stats count | addinfo | eval start=strftime('info_min_time', "%m/%d/%Y:%H:%M:%S") | return start] [| stats count | addinfo | eval end=strftime('info_max_time', "%m/%d/%Y:%H:%M:%S")\
| return end] increment=5m | eval _time=starttime | eval hostname="$host$"\
| timechart span=5m count by hostname | untable _time hostname count | fields - count ]\
| eval date_wday=if(isnull(date_wday), lower(strftime('_time', "%A")), date_wday)\
| eval local_time=if(isnull(local_time), strftime('_time', "%H%M"), local_time)\
| lookup nmon_baseline_LPAR date_wday,local_time,hostname\
| timechart `baseline_span` $statsmode$(lpar_pool_vp_usage) AS pool_usage, max(poolCPUs) AS poolCPUs, avg(baseline_avg_pool_usage) AS baseline_avg_pool_usage
iseval = 0

# Pool Virtual CPU usage with simple baseline - no future charting
[nmon_pool_usage_simple_baseline(2)]
args= host,statsmode
definition = mstats avg(_value) as value where `nmon_metrics_index` metric_name=os.unix.nmon.cpu.lpar.* host="$host$" by OStype, metric_name, host span=5m\
| `def_all_os_lpar_pool_load_cores`\
| rename host AS hostname\
| eval date_wday=if(isnull(date_wday), lower(strftime('_time', "%A")), date_wday)\
| eval local_time=if(isnull(local_time), strftime('_time', "%H%M"), local_time)\
| lookup nmon_baseline_LPAR date_wday,local_time,hostname\
| timechart `baseline_span` $statsmode$(lpar_pool_vp_usage) AS pool_usage, max(poolCPUs) AS poolCPUs, avg(baseline_avg_pool_usage) AS baseline_avg_pool_usage
iseval = 0

# Pool CPU usage with lower, average and upper baseline (predict command rendering) - future charting capable
[nmon_pool_usage_full_baseline_future(2)]
args= host,statsmode
definition = mstats avg(_value) as value where `nmon_metrics_index` metric_name=os.unix.nmon.cpu.lpar.* host="$host$" by OStype, metric_name, host span=5m\
| `def_all_os_lpar_pool_load_cores`\
| rename host AS hostname\
| append [ | gentimes [| stats count | addinfo | eval start=strftime('info_min_time', "%m/%d/%Y:%H:%M:%S") | return start] [| stats count | addinfo | eval end=strftime('info_max_time', "%m/%d/%Y:%H:%M:%S")\
| return end] increment=5m | eval _time=starttime | eval hostname="$host$"\
| timechart span=5m count by hostname | untable _time hostname count | fields - count ]\
| eval date_wday=if(isnull(date_wday), lower(strftime('_time', "%A")), date_wday)\
| eval local_time=if(isnull(local_time), strftime('_time', "%H%M"), local_time)\
| lookup nmon_baseline_LPAR date_wday,local_time,hostname\
| timechart `baseline_span` $statsmode$(lpar_pool_vp_usage) AS pool_usage, max(poolCPUs) AS poolCPUs, avg(lower_baseline_avg_pool_usage) AS lower, avg(baseline_avg_pool_usage) AS predicted, avg(upper_baseline_avg_pool_usage) AS upper\
| eval _lower = "lower" | eval _predicted = "predicted" | eval _upper = "upper"
iseval = 0

# Pool CPU usage with lower, average and upper baseline (predict command rendering) - no future charting
[nmon_pool_usage_full_baseline(2)]
args= host,statsmode
definition = mstats avg(_value) as value where `nmon_metrics_index` metric_name=os.unix.nmon.cpu.lpar.* host="$host$" by OStype, metric_name, host span=5m\
| `def_all_os_lpar_pool_load_cores`\
| rename host AS hostname\
| eval date_wday=if(isnull(date_wday), lower(strftime('_time', "%A")), date_wday)\
| eval local_time=if(isnull(local_time), strftime('_time', "%H%M"), local_time)\
| lookup nmon_baseline_LPAR date_wday,local_time,hostname\
| timechart `baseline_span` $statsmode$(lpar_pool_vp_usage) AS pool_usage, max(poolCPUs) AS poolCPUs, avg(lower_baseline_avg_pool_usage) AS lower, avg(baseline_avg_pool_usage) AS predicted, avg(upper_baseline_avg_pool_usage) AS upper\
| eval _lower = "lower" | eval _predicted = "predicted" | eval _upper = "upper"
iseval = 0

#
# MEM
# Average Real and Virtual Memory usage, relevant for ALL OS
#

# Real Memory Usage (in percentage) with simple baseline - future charting capabable
[nmon_real_mem_simple_baseline_future(2)]
args= host,statsmode
definition = mstats avg(_value) as value where `nmon_metrics_index` `def_memory_all_os_metric_filters` (host=$host$) by OStype, metric_name, host span=5m\
| `def_memory_load_percent`\
| rename host AS hostname\
| append [ | gentimes [| stats count | addinfo | eval start=strftime('info_min_time', "%m/%d/%Y:%H:%M:%S") | return start] [| stats count | addinfo | eval end=strftime('info_max_time', "%m/%d/%Y:%H:%M:%S")\
| return end] increment=5m | eval _time=starttime | eval hostname="$host$"\
| timechart span=5m count by hostname | untable _time hostname count | fields - count ]\
| eval date_wday=if(isnull(date_wday), lower(strftime('_time', "%A")), date_wday)\
| eval local_time=if(isnull(local_time), strftime('_time', "%H%M"), local_time)\
| lookup nmon_baseline_MEM date_wday,local_time,hostname\
| timechart `baseline_span` $statsmode$(mem_used_effective_PCT) AS avg_real_mem, avg(baseline_avg_real_mem) AS baseline_avg_real_mem
iseval = 0

# Real Memory Usage (in percentage) with simple baseline - no future charting
[nmon_real_mem_simple_baseline(2)]
args= host,statsmode
definition = mstats avg(_value) as value where `nmon_metrics_index` `def_memory_all_os_metric_filters` (host=$host$) by OStype, metric_name, host span=5m\
| `def_memory_load_percent`\
| rename host AS hostname\
| eval date_wday=if(isnull(date_wday), lower(strftime('_time', "%A")), date_wday)\
| eval local_time=if(isnull(local_time), strftime('_time', "%H%M"), local_time)\
| lookup nmon_baseline_MEM date_wday,local_time,hostname\
| timechart `baseline_span` $statsmode$(mem_used_effective_PCT) AS avg_real_mem, avg(baseline_avg_real_mem) AS baseline_avg_real_mem
iseval = 0

# Real Memory Usage (in percentage) with lower, average and upper baseline (predict command rendering) - future charting capable
[nmon_real_mem_full_baseline_future(2)]
args= host,statsmode
definition = mstats avg(_value) as value where `nmon_metrics_index` `def_memory_all_os_metric_filters` (host=$host$) by OStype, metric_name, host span=5m\
| `def_memory_load_percent`\
| rename host AS hostname\
| append [ | gentimes [| stats count | addinfo | eval start=strftime('info_min_time', "%m/%d/%Y:%H:%M:%S") | return start] [| stats count | addinfo | eval end=strftime('info_max_time', "%m/%d/%Y:%H:%M:%S")\
| return end] increment=5m | eval _time=starttime | eval hostname="$host$"\
| timechart span=5m count by hostname | untable _time hostname count | fields - count ]\
| eval date_wday=if(isnull(date_wday), lower(strftime('_time', "%A")), date_wday)\
| eval local_time=if(isnull(local_time), strftime('_time', "%H%M"), local_time)\
| lookup nmon_baseline_MEM date_wday,local_time,hostname\
| timechart `baseline_span` $statsmode$(mem_used_effective_PCT) AS avg_real_mem, avg(lower_baseline_avg_real_mem) AS lower, avg(baseline_avg_real_mem) AS predicted, avg(upper_baseline_avg_real_mem) AS upper\
| eval _lower = "lower" | eval _predicted = "predicted" | eval _upper = "upper"
iseval = 0

# Real Memory Usage (in percentage) with lower, average and upper baseline (predict command rendering) - no future charting
[nmon_real_mem_full_baseline(2)]
args= host,statsmode
definition = mstats avg(_value) as value where `nmon_metrics_index` `def_memory_all_os_metric_filters` (host=$host$) by OStype, metric_name, host span=5m\
| `def_memory_load_percent`\
| rename host AS hostname\
| eval date_wday=if(isnull(date_wday), lower(strftime('_time', "%A")), date_wday)\
| eval local_time=if(isnull(local_time), strftime('_time', "%H%M"), local_time)\
| lookup nmon_baseline_MEM date_wday,local_time,hostname\
| timechart `baseline_span` $statsmode$(mem_used_effective_PCT) AS avg_real_mem, avg(lower_baseline_avg_real_mem) AS lower, avg(baseline_avg_real_mem) AS predicted, avg(upper_baseline_avg_real_mem) AS upper\
| eval _lower = "lower" | eval _predicted = "predicted" | eval _upper = "upper"
iseval = 0

# Virtual Memory Usage (in percentage) with simple baseline - future charting capable
[nmon_virtual_mem_simple_baseline_future(2)]
args= host,statsmode
definition = mstats avg(_value) as value where `nmon_metrics_index` `def_memory_all_os_metric_filters` (host=$host$) by OStype, metric_name, host span=5m\
| `def_memory_load_percent`\
| rename host AS hostname\
| append [ | gentimes [| stats count | addinfo | eval start=strftime('info_min_time', "%m/%d/%Y:%H:%M:%S") | return start] [| stats count | addinfo | eval end=strftime('info_max_time', "%m/%d/%Y:%H:%M:%S")\
| return end] increment=5m | eval _time=starttime | eval hostname="$host$"\
| timechart span=5m count by hostname | untable _time hostname count | fields - count ]\
| eval date_wday=if(isnull(date_wday), lower(strftime('_time', "%A")), date_wday)\
| eval local_time=if(isnull(local_time), strftime('_time', "%H%M"), local_time)\
| lookup nmon_baseline_MEM date_wday,local_time,hostname\
| timechart `baseline_span` $statsmode$(swap_used_effective_PCT) AS avg_virtual_mem, avg(baseline_avg_virtual_mem) AS baseline_avg_virtual_mem
iseval = 0

# Virtual Memory Usage (in percentage) with simple baseline - no future charting
[nmon_virtual_mem_simple_baseline(2)]
args= host,statsmode
definition = mstats avg(_value) as value where `nmon_metrics_index` `def_memory_all_os_metric_filters` (host=$host$) by OStype, metric_name, host span=5m\
| `def_memory_load_percent`\
| rename host AS hostname\
| eval date_wday=if(isnull(date_wday), lower(strftime('_time', "%A")), date_wday)\
| eval local_time=if(isnull(local_time), strftime('_time', "%H%M"), local_time)\
| lookup nmon_baseline_MEM date_wday,local_time,hostname\
| timechart `baseline_span` $statsmode$(swap_used_effective_PCT) AS avg_virtual_mem, avg(baseline_avg_virtual_mem) AS baseline_avg_virtual_mem
iseval = 0

# Virtual Memory Usage (in percentage) with lower, average and upper baseline (predict command rendering) - future charting capable
[nmon_virtual_mem_full_baseline_future(2)]
args= host,statsmode
definition = mstats avg(_value) as value where `nmon_metrics_index` `def_memory_all_os_metric_filters` (host=$host$) by OStype, metric_name, host span=5m\
| `def_memory_load_percent`\
| rename host AS hostname\
| append [ | gentimes [| stats count | addinfo | eval start=strftime('info_min_time', "%m/%d/%Y:%H:%M:%S") | return start] [| stats count | addinfo | eval end=strftime('info_max_time', "%m/%d/%Y:%H:%M:%S")\
| return end] increment=5m | eval _time=starttime | eval hostname="$host$"\
| timechart span=5m count by hostname | untable _time hostname count | fields - count ]\
| eval date_wday=if(isnull(date_wday), lower(strftime('_time', "%A")), date_wday)\
| eval local_time=if(isnull(local_time), strftime('_time', "%H%M"), local_time)\
| lookup nmon_baseline_MEM date_wday,local_time,hostname\
| timechart `baseline_span` $statsmode$(swap_used_effective_PCT) AS avg_virtual_mem, avg(lower_baseline_avg_virtual_mem) AS lower, avg(baseline_avg_virtual_mem) AS predicted, avg(upper_baseline_avg_virtual_mem) AS upper\
| eval _lower = "lower" | eval _predicted = "predicted" | eval _upper = "upper"
iseval = 0

# Virtual Memory Usage (in percentage) with lower, average and upper baseline (predict command rendering) - no future charting
[nmon_virtual_mem_full_baseline(2)]
args= host,statsmode
definition = mstats avg(_value) as value where `nmon_metrics_index` `def_memory_all_os_metric_filters` (host=$host$) by OStype, metric_name, host span=5m\
| `def_memory_load_percent`\
| rename host AS hostname\
| eval date_wday=if(isnull(date_wday), lower(strftime('_time', "%A")), date_wday)\
| eval local_time=if(isnull(local_time), strftime('_time', "%H%M"), local_time)\
| lookup nmon_baseline_MEM date_wday,local_time,hostname\
| timechart `baseline_span` $statsmode$(swap_used_effective_PCT) AS avg_virtual_mem, avg(lower_baseline_avg_virtual_mem) AS lower, avg(baseline_avg_virtual_mem) AS predicted, avg(upper_baseline_avg_virtual_mem) AS upper\
| eval _lower = "lower" | eval _predicted = "predicted" | eval _upper = "upper"
iseval = 0

#
# DISKXFER
# Average Number of disk I/O per sec stats, relevant for ALL OS
#

# Average IOPS with simple baseline - future charting capable
[nmon_iops_simple_baseline_future(2)]
args= host,statsmode
definition = mstats sum(_value) as value where `nmon_metrics_index` metric_name=os.unix.nmon.storage.diskxfer OR metric_name=os.unix.nmon.storage.dgxfer host=$host$ by metric_name, host span=1m\
| `extract_metrics`\
| eval diskxfer_iops=case(metric_name=="os.unix.nmon.storage.diskxfer", value), dgxfer_iops=case(metric_name=="os.unix.nmon.storage.dgxfer", value)\
| stats max(diskxfer_iops) as diskxfer_iops, max(dgxfer_iops) as dgxfer_iops by _time, host\
| eval iops=if(isnum(dgxfer_iops), dgxfer_iops, diskxfer_iops)\
| bucket _time span=5m\
| stats avg(iops) as iops by _time, host\
| rename host AS hostname\
| append [ | gentimes [| stats count | addinfo | eval start=strftime('info_min_time', "%m/%d/%Y:%H:%M:%S") | return start] [| stats count | addinfo | eval end=strftime('info_max_time', "%m/%d/%Y:%H:%M:%S")\
| return end] increment=5m | eval _time=starttime | eval hostname="$host$"\
| timechart span=5m count by hostname | untable _time hostname count | fields - count ]\
| eval date_wday=if(isnull(date_wday), lower(strftime('_time', "%A")), date_wday)\
| eval local_time=if(isnull(local_time), strftime('_time', "%H%M"), local_time)\
| lookup nmon_baseline_DISKXFER date_wday,local_time,hostname\
| timechart `baseline_span` $statsmode$(iops) AS disk_iops, avg(baseline_avg_disk_iops) AS baseline_disk_iops
iseval = 0

# Average IOPS with simple baseline - no future charting
[nmon_iops_simple_baseline(2)]
args= host,statsmode
definition = mstats sum(_value) as value where `nmon_metrics_index` metric_name=os.unix.nmon.storage.diskxfer OR metric_name=os.unix.nmon.storage.dgxfer host=$host$ by metric_name, host span=1m\
| `extract_metrics`\
| eval diskxfer_iops=case(metric_name=="os.unix.nmon.storage.diskxfer", value), dgxfer_iops=case(metric_name=="os.unix.nmon.storage.dgxfer", value)\
| stats max(diskxfer_iops) as diskxfer_iops, max(dgxfer_iops) as dgxfer_iops by _time, host\
| eval iops=if(isnum(dgxfer_iops), dgxfer_iops, diskxfer_iops)\
| bucket _time span=5m\
| stats avg(iops) as iops by _time, host\
| rename host AS hostname\
| eval date_wday=if(isnull(date_wday), lower(strftime('_time', "%A")), date_wday)\
| eval local_time=if(isnull(local_time), strftime('_time', "%H%M"), local_time)\
| lookup nmon_baseline_DISKXFER date_wday,local_time,hostname\
| timechart `baseline_span` $statsmode$(iops) AS disk_iops, avg(baseline_avg_disk_iops) AS baseline_disk_iops
iseval = 0

# Average IOPS with lower, average and upper baseline (predict command rendering) - future charting capable
[nmon_iops_full_baseline_future(2)]
args= host,statsmode
definition = mstats sum(_value) as value where `nmon_metrics_index` metric_name=os.unix.nmon.storage.diskxfer OR metric_name=os.unix.nmon.storage.dgxfer host=$host$ by metric_name, host span=1m\
| `extract_metrics`\
| eval diskxfer_iops=case(metric_name=="os.unix.nmon.storage.diskxfer", value), dgxfer_iops=case(metric_name=="os.unix.nmon.storage.dgxfer", value)\
| stats max(diskxfer_iops) as diskxfer_iops, max(dgxfer_iops) as dgxfer_iops by _time, host\
| eval iops=if(isnum(dgxfer_iops), dgxfer_iops, diskxfer_iops)\
| bucket _time span=5m\
| stats avg(iops) as iops by _time, host\
| rename host AS hostname\
| append [ | gentimes [| stats count | addinfo | eval start=strftime('info_min_time', "%m/%d/%Y:%H:%M:%S") | return start] [| stats count | addinfo | eval end=strftime('info_max_time', "%m/%d/%Y:%H:%M:%S")\
| return end] increment=5m | eval _time=starttime | eval hostname="$host$"\
| timechart span=5m count by hostname | untable _time hostname count | fields - count ]\
| eval date_wday=if(isnull(date_wday), lower(strftime('_time', "%A")), date_wday)\
| eval local_time=if(isnull(local_time), strftime('_time', "%H%M"), local_time)\
| lookup nmon_baseline_DISKXFER date_wday,local_time,hostname\
| timechart `baseline_span` $statsmode$(iops) AS disk_iops,\
avg(lower_baseline_avg_disk_iops) AS lower, avg(baseline_avg_disk_iops) AS predicted, avg(upper_baseline_avg_disk_iops) AS upper\
| eval _lower = "lower" | eval _predicted = "predicted" | eval _upper = "upper"
iseval = 0

# Average IOPS with lower, average and upper baseline (predict command rendering) - no future charting
[nmon_iops_full_baseline(2)]
args= host,statsmode
definition = mstats sum(_value) as value where `nmon_metrics_index` metric_name=os.unix.nmon.storage.diskxfer OR metric_name=os.unix.nmon.storage.dgxfer host=$host$ by metric_name, host span=1m\
| `extract_metrics`\
| eval diskxfer_iops=case(metric_name=="os.unix.nmon.storage.diskxfer", value), dgxfer_iops=case(metric_name=="os.unix.nmon.storage.dgxfer", value)\
| stats max(diskxfer_iops) as diskxfer_iops, max(dgxfer_iops) as dgxfer_iops by _time, host\
| eval iops=if(isnum(dgxfer_iops), dgxfer_iops, diskxfer_iops)\
| bucket _time span=5m\
| stats avg(iops) as iops by _time, host\
| rename host AS hostname\
| eval date_wday=if(isnull(date_wday), lower(strftime('_time', "%A")), date_wday)\
| eval local_time=if(isnull(local_time), strftime('_time', "%H%M"), local_time)\
| lookup nmon_baseline_DISKXFER date_wday,local_time,hostname\
| timechart `baseline_span` $statsmode$(iops) AS disk_iops,\
avg(lower_baseline_avg_disk_iops) AS lower, avg(baseline_avg_disk_iops) AS predicted, avg(upper_baseline_avg_disk_iops) AS upper\
| eval _lower = "lower" | eval _predicted = "predicted" | eval _upper = "upper"
iseval = 0
