Hi sunnyparmar
Try this search code
|set union [search index=sc-perfmon counter="Avg. Disk sec/Read"| timechart avg(Value) by host] [ search index=sc-perfmon counter="Avg. Disk sec/Write" | timechart avg(Value) by host]
Hi sunnyparmar
Try this search code
|set union [search index=sc-perfmon counter="Avg. Disk sec/Read"| timechart avg(Value) by host] [ search index=sc-perfmon counter="Avg. Disk sec/Write" | timechart avg(Value) by host]
Hey,
thanks for the reply but it is given below error when I am running the below query
index=sc-perfmon (counter="Avg. Disk sec/Read" OR counter="Avg. Disk sec/Write" ) | set union [search index=sc-perfmon counter="Avg. Disk sec/Read"| timechart avg(Value) by host] [ search index=sc-perfmon counter="Avg. Disk sec/Write" | timechart avg(Value) by host]
ERROR
Error in 'set' command: This command must be the first command of a search.
Thanks & Regards
Sunny
Don't add something to the search code that i gave you just run it
it works well will my data
Delete index=sc-perfmon (counter="Avg. Disk sec/Read" OR counter="Avg. Disk sec/Write" ) and re-run
Note that the search which contain a set command always begin with | set
Ultimate.. it works...thanks once again
Good thanks
HI TRY THIS
index=sc-perfmon (counter="Avg. Disk sec/Read" OR counter="Avg. Disk sec/Write" ) | timechart avg(Value) by host
Hey,
Thanks for the reply but if I did it by host only then query runs and it is showing data by host. Then when I will click on show events under it, it will show data for further parameter (Avg. Disk sec/Read and Avg. Disk sec/Write)but what I want that it will show data hostwise for both (counter="Avg. Disk sec/Read" OR counter="Avg. Disk sec/Write") counters in output.
and
Second query is not running.. it is giving an error.
Regards
Ankit