I'm trying to format the output from Windows perflogs into a nice table. The way the events are formatted, with separate events with "object" and "Value" fields each, has thrown my brain for a loop. How would I change this table:
host object Value
HOSTA PagingFile 11.070782
HOSTA Processor 4.480732
HOSTB PagingFile 13.441306
HOSTB Processor 7.368559
Into
host PagingFile Processor
HOSTA 11.070782 4.480732
HOSTB 13.441306 7.368559
The original search:
index=perflog CPU OR pagefile | stats avg(Value) as Value by host object
Use chart
instead of stats
.
index=perflog CPU or pagefile | chart avg(value) by host,object
Use chart
instead of stats
.
index=perflog CPU or pagefile | chart avg(value) by host,object