Currently I am using appendcols method, it seems work, but once the first search returns no result, the timechart will not show the subsearch results, my script is as below, it's just joining up the scripts in app nix and windows with appendcols, is there any solution for this issue?
sourcetype=WMI:CPUTime host=$host$
| timechart avg(PercentProcessorTime) by host
| appendcols [ search sourcetype=cpu host=$host$
| multikv fields pctIdle
| eval Percent_CPU_Load = 100 - pctIdle
| timechart avg(Percent_CPU_Load) by host ]
... View more