BW
Device_Name="*
*"
OR
Device_Name
Device_Name
index="idx_tic_spectrum_dev" in_bitrate=*
| rex Field=Model_Name "(?<Device_Name>.*)_(?<Interface_Name>[A-Za-z0-9/]{0,8}[0-9])"
| table Device_Name
| dedup Device_Name
| sort Device_Name
-15m
now
ALL
*
Model_Name="
"
OR
Model_Name
Model_Name
index="idx_tic_spectrum_dev" in_bitrate=*
| rex Field=Model_Name "(?<Device_Name>.*)_(?<Interface_Name>[A-Za-z0-9/]{0,8}[0-9])"
| search $devices$
| table Model_Name
| dedup Model_Name
| sort Model_Name
-15m
now
index="idx_tic_spectrum_dev" in_bitrate=*
| rex Field=Model_Name "(?<Device_Name>.*)_(?<Interface_Name>[A-Za-z0-9/]{0,8}[0-9])"
| search ($devices$) AND ($mnames$)
| timechart span=1m avg(in_bitrate) as in_bitrate, avg(out_bitrate) as out_bitrate by Model_Name
$field1.earliest$
$field1.latest$
Memory Usage
Model_Name="*
*"
OR
Model_Name
Model_Name
index="idx_tic_spectrum_dev" | foreach CPU.* [|eval CPU=if(isnull('<<FIELD>>'),CPU,'<<FIELD>>')]
| search CPU=*
| table Model_Name
| dedup Model_Name
| sort Model_Name
-15m
now
index=idx_tic_spectrum_dev $devices2$
| foreach Memory.*.Memory_Used [eval "Memory.<<MATCHSEG1>>.usage" = 100 * 'Memory.<<MATCHSEG1>>.Memory_Used' / ('Memory.<<MATCHSEG1>>.Memory_Used' + 'Memory.<<MATCHSEG1>>.Memory_Free')
| eval Inv = if(isnull(Inv),"Memory.<<MATCHSEG1>>,"+'Memory.<<MATCHSEG1>>.usage',mvappend(Inv,"Memory.<<MATCHSEG1>>,"+'Memory.<<MATCHSEG1>>.usage'))]
| foreach CPU.* [| eval Inv = if(isnull(Inv),"CPU.<<MATCHSEG1>>,"+'CPU.<<MATCHSEG1>>',mvappend(Inv,"CPU.<<MATCHSEG1>>,"+'CPU.<<MATCHSEG1>>'))]
| search Inv=*
| mvexpand Inv
| rex field=Inv "(?<inv_name>.*),(?<percent>.*)"
| eval inv_name = Model_Name + "_" + inv_name
| timechart span=1m avg(percent) by inv_name
$field1.earliest$
$field1.latest$