06 May 2026 06:36 PM
timeseries { cpu_usage_percent = avg(dt.host.cpu.usage) }, by:{ dt.entity.host }, nonempty:true
| fieldsAdd hostname = entityName(dt.entity.host)
| filter in(hostname, $DEVICENAME) // optional: filter by a list variable
| fieldsAdd `% usage` = arrayLast(cpu_usage_percent)
| fieldsAdd output = if((`% usage` > 90), `% usage`, else: 0)
| summarize `Usage > 90%` = sum(output), by: {dt.entity.host}
| fields `Usage > 90%`, entityName(dt.entity.host)
| filterOut `Usage > 90%` < 90
If there is no record returned (If there are no hosts with CPU usage greater than 90%) then instead of displaying as No records, adjust timeframe default message, I want it to show as 0 and as honeycomb view.
How to achieve it, help with modified query
06 May 2026 07:38 PM
Hello @learndt!
If think you want this below:
timeseries cpu_usage_percent = avg(dt.host.cpu.usage),
by:{ dt.entity.host },
nonempty:true
| fieldsAdd hostname = entityName(dt.entity.host)
| filter in(hostname, $DEVICENAME)
| fieldsAdd `% usage` = arrayLast(cpu_usage_percent)
| filter `% usage` > 90
| summarize `Usage > 90%` = count()
| fieldsAdd label = "Hosts with CPU > 90%"
| fields label, `Usage > 90%`I hope it helps 😊
Featured Posts