Hey Peter,
I spent some time on this and got as close as I could. It seems like not many have tried a query like this before. I couldn’t sort all fields due to inconsistent values, so I stuck with sorting by cpu_usage.
Hope this helps!
timeseries avg(dt.process.cpu.usage), by: { dt.entity.process_group_instance }
| fieldsAdd dt.entity.process_group_instance.name = entityName(dt.entity.process_group_instance)
| fieldsAdd cpu_usage = arrayAvg(`avg(dt.process.cpu.usage)`)
| lookup [
timeseries values=avg(dt.process.io.bytes_total), by: { dt.entity.process_group_instance }
| fieldsAdd io_usage = arrayAvg(values)
], sourceField:dt.entity.process_group_instance, lookupField:dt.entity.process_group_instance, fields:{io_usage}, executionOrder:leftFirst
| lookup [
timeseries values=avg(dt.process.memory.usage), by: { dt.entity.process_group_instance }
| fieldsAdd memory_usage = arrayAvg(values)
], sourceField:dt.entity.process_group_instance, lookupField:dt.entity.process_group_instance, fields:{memory_usage}, executionOrder:leftFirst
| lookup [
timeseries values=avg(dt.process.network.bytes_rx), by: { dt.entity.process_group_instance }
| fieldsAdd net_rx = arrayAvg(values)
], sourceField:dt.entity.process_group_instance, lookupField:dt.entity.process_group_instance, fields:{net_rx}, executionOrder:leftFirst
| lookup [
timeseries values=avg(dt.process.network.bytes_tx), by: { dt.entity.process_group_instance }
| fieldsAdd net_tx = arrayAvg(values)
], sourceField:dt.entity.process_group_instance, lookupField:dt.entity.process_group_instance, fields:{net_tx}, executionOrder:leftFirst
| lookup [
fetch dt.entity.process_group_instance
| fieldsAdd host_id = belongs_to[dt.entity.host], process_name = entity.name
| lookup
[
fetch dt.entity.host
| fields id, hostname = entity.name, hostGroupName
], sourceField:host_id, lookupField:id, prefix:"result."
], sourceField:dt.entity.process_group_instance, lookupField:id, fields:{result.hostname}
| fieldsRemove `avg(dt.process.cpu.usage)`
| sort cpu_usage desc
