https://community.splunk.com/t5/Splunk-Search/merging-two-search-strings/m-p/75032#M18958 <P>I need the result of both the search string combined in a same window.</P> Mon, 31 Dec 2012 19:23:25 GMT Splunk_U 2012-12-31T19:23:25Z https://community.splunk.com/t5/Splunk-Search/merging-two-search-strings/m-p/75029#M18955 <P>Can you please help me out to merge these two search strings</P> <PRE><CODE>index=os sourcetype=vmstat | multikv fields memUsedPct | stats avg(memUsedPct) as avgMemUse max(memUsedPct) as pkMemUse by host | join host [ search index=os sourcetype=cpu | multikv fields pctIdle | search all | eval Percent_CPU_Load = 100 - pctIdle | stats avg(Percent_CPU_Load) as avgCpuUse max(Percent_CPU_Load) as pkCpuUse by host ] </CODE></PRE> <P>and </P> <PRE><CODE>index=os sourcetype=perfmon* | stats avg(Value) as Average max(Value) as Max by host counter </CODE></PRE> Mon, 31 Dec 2012 13:41:54 GMT https://community.splunk.com/t5/Splunk-Search/merging-two-search-strings/m-p/75029#M18955 Splunk_U 2012-12-31T13:41:54Z https://community.splunk.com/t5/Splunk-Search/merging-two-search-strings/m-p/75030#M18956 <P>Do you really need these stats combined? Or could you put both searches on a dashboard, where you could see the results side-by-side?</P> Mon, 31 Dec 2012 18:48:11 GMT https://community.splunk.com/t5/Splunk-Search/merging-two-search-strings/m-p/75030#M18956 lguinn2 2012-12-31T18:48:11Z https://community.splunk.com/t5/Splunk-Search/merging-two-search-strings/m-p/75031#M18957 <P>Just keep following the pattern....</P> <PRE><CODE>index=os sourcetype=vmstat | multikv fields memUsedPct | stats avg(memUsedPct) as avgMemUse max(memUsedPct) as pkMemUse by host | join host [ search index=os sourcetype=cpu | multikv fields pctIdle | search all | eval Percent_CPU_Load = 100 - pctIdle | stats avg(Percent_CPU_Load) as avgCpuUse max(Percent_CPU_Load) as pkCpuUse by host ] | join host [ search index=os sourcetype=perfmon* | stats avg(Value) as Average max(Value) as Max by host counter ] </CODE></PRE> <P>Although I don't think that is going to work exactly the way you want...</P> Mon, 31 Dec 2012 18:50:30 GMT https://community.splunk.com/t5/Splunk-Search/merging-two-search-strings/m-p/75031#M18957 lguinn2 2012-12-31T18:50:30Z https://community.splunk.com/t5/Splunk-Search/merging-two-search-strings/m-p/75032#M18958 <P>I need the result of both the search string combined in a same window.</P> Mon, 31 Dec 2012 19:23:25 GMT https://community.splunk.com/t5/Splunk-Search/merging-two-search-strings/m-p/75032#M18958 Splunk_U 2012-12-31T19:23:25Z https://community.splunk.com/t5/Splunk-Search/merging-two-search-strings/m-p/75033#M18959 <P>No it is not working...I have tried the same follow ... <span class="lia-unicode-emoji" title=":disappointed_face:">😞</span></P> Mon, 31 Dec 2012 19:24:04 GMT https://community.splunk.com/t5/Splunk-Search/merging-two-search-strings/m-p/75033#M18959 Splunk_U 2012-12-31T19:24:04Z https://community.splunk.com/t5/Splunk-Search/merging-two-search-strings/m-p/75034#M18960 <P>What output do you get from this search?</P> <P><CODE>index=os sourcetype=perfmon* <BR /> | stats avg(Value) as Average max(Value) as Max by host counter</CODE></P> Mon, 31 Dec 2012 19:40:17 GMT https://community.splunk.com/t5/Splunk-Search/merging-two-search-strings/m-p/75034#M18960 lguinn2 2012-12-31T19:40:17Z