https://community.splunk.com/t5/Splunk-Search/join-in-search-string/m-p/85572#M21868 <P>I have a search string</P> <P>index=os source=vmstat <BR /> | multikv fields memUsedPct memTotalMB memFreeMB<BR /> | stats avg(memUsedPct) as avgMemPct max(memUsedPct) as peakMemPct avg(memUsedMB) as avgMemMb max(memUsedMB) as peakMemMb by host<BR /> | join host [ search index=os source=cpu <BR /> | multikv fields pctIdle<BR /><BR /> | search all<BR /><BR /> | eval Percent_CPU_Load = 100 - pctIdle<BR /><BR /> | stats avg(Percent_CPU_Load) as avgCpuPct max(Percent_CPU_Load) as peakCpuPct by host</P> <P>Now is there any way that I can get the same result without doing join??</P> Mon, 28 Sep 2020 13:05:40 GMT Splunk_U 2020-09-28T13:05:40Z https://community.splunk.com/t5/Splunk-Search/join-in-search-string/m-p/85572#M21868 <P>I have a search string</P> <P>index=os source=vmstat <BR /> | multikv fields memUsedPct memTotalMB memFreeMB<BR /> | stats avg(memUsedPct) as avgMemPct max(memUsedPct) as peakMemPct avg(memUsedMB) as avgMemMb max(memUsedMB) as peakMemMb by host<BR /> | join host [ search index=os source=cpu <BR /> | multikv fields pctIdle<BR /><BR /> | search all<BR /><BR /> | eval Percent_CPU_Load = 100 - pctIdle<BR /><BR /> | stats avg(Percent_CPU_Load) as avgCpuPct max(Percent_CPU_Load) as peakCpuPct by host</P> <P>Now is there any way that I can get the same result without doing join??</P> Mon, 28 Sep 2020 13:05:40 GMT https://community.splunk.com/t5/Splunk-Search/join-in-search-string/m-p/85572#M21868 Splunk_U 2020-09-28T13:05:40Z https://community.splunk.com/t5/Splunk-Search/join-in-search-string/m-p/85573#M21869 <P>How does this work?</P> <P>index=os AND ( source=cpu OR source=vmstat) | multikv fields memUsedPct memTotalMB memFreeMB pctIdle | eval Percent_CPU_Load = 100 - pctIdle | stats avg(memUsedPct) as avgMemPct max(memUsedPct) as peakMemPct avg(memUsedMB) as avgMemMb max(memUsedMB) as peakMemMb avg(Percent_CPU_Load) as avgCpuPct max(Percent_CPU_Load) as peakCpuPct by host </P> Mon, 28 Sep 2020 13:05:43 GMT https://community.splunk.com/t5/Splunk-Search/join-in-search-string/m-p/85573#M21869 cramasta 2020-09-28T13:05:43Z