Can you please help me out to merge these two search strings
index=os sourcetype=vmstat
| multikv fields memUsedPct
| stats avg(memUsedPct) as avgMemUse max(memUsedPct) as pkMemUse by host
| join host [ search index=os sourcetype=cpu
| multikv fields pctIdle
| search all
| eval Percent_CPU_Load = 100 - pctIdle
| stats avg(Percent_CPU_Load) as avgCpuUse max(Percent_CPU_Load) as pkCpuUse by host ]
and
index=os sourcetype=perfmon*
| stats avg(Value) as Average max(Value) as Max by host counter
I need the result of both the search string combined in a same window.
Just keep following the pattern....
index=os sourcetype=vmstat
| multikv fields memUsedPct
| stats avg(memUsedPct) as avgMemUse max(memUsedPct) as pkMemUse by host
| join host [ search index=os sourcetype=cpu
| multikv fields pctIdle
| search all
| eval Percent_CPU_Load = 100 - pctIdle
| stats avg(Percent_CPU_Load) as avgCpuUse max(Percent_CPU_Load) as pkCpuUse by host ]
| join host [ search index=os sourcetype=perfmon*
| stats avg(Value) as Average max(Value) as Max by host counter ]
Although I don't think that is going to work exactly the way you want...
What output do you get from this search?
index=os sourcetype=perfmon*
| stats avg(Value) as Average max(Value) as Max by host counter
No it is not working...I have tried the same follow ... 😞
Do you really need these stats combined? Or could you put both searches on a dashboard, where you could see the results side-by-side?