fetch dt.entity.host_group
| lookup [
timeseries {
CPU=max(dt.host.cpu.usage),
Memory=max(dt.host.memory.usage),
Disk=max(dt.host.disk.used.percent),
TrafficIn=max(dt.host.net.nic.bytes_rx),
TrafficOut=max(dt.host.net.nic.bytes_tx)
}, by: {dt.entity.host_group}
| append [timeseries by:{dt.host_group.id}, availability_sum = sum(dt.host.availability)]
| fields CPU=arrayLast(CPU),
Memory=arrayLast(Memory),
Disk=arrayLast(Disk),
TrafficIn=arrayLast(TrafficIn),
TrafficOut=arrayLast(TrafficOut),
availability=availability_sum,
dt.entity.host_group
], sourceField:id,
lookupField:dt.entity.host_group,
fields: {availability, CPU, Memory, Disk},
executionOrder:leftFirst
| fieldsAdd status = if(CPU >= 90 or Memory >= 90 or Disk >= 90, "🛑", else: if(CPU >= 80 or Memory >= 80 or Disk >= 80, "🟡", else: "🟢"))
| sort entity.name desc
| sort status asc
| filter CPU >=10
| limit 100
