https://community.splunk.com/t5/Splunk-Search/serach-string-combination/m-p/73323#M18337 <P>This should do it:</P> <PRE><CODE>index=os sourcetype=vmstat | multikv fields memUsedPct | stats avg(memUsedPct) max(memUsedPct) by host | join host [ search index=os sourcetype=cpu | multikv fields pctIdle | search all | eval Percent_CPU_Load = 100 - pctIdle | stats avg(Percent_CPU_Load) as Average max(Percent_CPU_Load) as Peak by host ] </CODE></PRE> Thu, 27 Dec 2012 06:10:04 GMT lguinn2 2012-12-27T06:10:04Z https://community.splunk.com/t5/Splunk-Search/serach-string-combination/m-p/73322#M18336 <P>I want to create a sreach string that will provide the avegCPU util, PeakCPU util, AvgMem util and PeakMem util.<BR /> I have created four different search string. How to combine them?</P> <P>average memory usage<BR /> index=os sourcetype=vmstat | multikv fields memUsedPct | stats avg(memUsedPct) by host</P> <P>peak memory usage<BR /> index=os sourcetype=vmstat | multikv fields memUsedPct | stats max(memUsedPct) by host</P> <P>average CPU usage<BR /> index=os sourcetype=cpu | multikv fields pctIdle | search all | eval Percent_CPU_Load = 100 - pctIdle | stats avg(Percent_CPU_Load) as Average by host</P> <P>Peak CPU usage<BR /> index=os sourcetype=cpu | multikv fields pctIdle | search all | eval Percent_CPU_Load = 100 - pctIdle | stats max(Percent_CPU_Load) as Peak by host</P> <P>HELP me out!!!!</P> Mon, 28 Sep 2020 13:01:05 GMT https://community.splunk.com/t5/Splunk-Search/serach-string-combination/m-p/73322#M18336 Splunk_U 2020-09-28T13:01:05Z https://community.splunk.com/t5/Splunk-Search/serach-string-combination/m-p/73323#M18337 <P>This should do it:</P> <PRE><CODE>index=os sourcetype=vmstat | multikv fields memUsedPct | stats avg(memUsedPct) max(memUsedPct) by host | join host [ search index=os sourcetype=cpu | multikv fields pctIdle | search all | eval Percent_CPU_Load = 100 - pctIdle | stats avg(Percent_CPU_Load) as Average max(Percent_CPU_Load) as Peak by host ] </CODE></PRE> Thu, 27 Dec 2012 06:10:04 GMT https://community.splunk.com/t5/Splunk-Search/serach-string-combination/m-p/73323#M18337 lguinn2 2012-12-27T06:10:04Z