The following query will output CPU usage per host over a period of time using timechart: index=os sourcetype=top pctCPU=* | transaction host _time | streamstats window=1 global=f sum(pctCPU) as CPU | timechart latest(CPU) by host
Average CPU Usage on a Windows box
This query will return the average CPU usage by minute. sourcetype=”Perfmon:CPU Load” | bucket _time span=1m | stats avg(Value) by _time
