topic merging two search strings in Splunk Search

merging two search strings

Splunk_U — Mon, 14 Jan 2013 19:37:52 GMT

I have two search string:
index=os source=Perfmon:LocalMainMemory
| where like(counter,"% Committed Bytes In Use")
| stats avg(Value) as "avgMemPct", max(Value) as "peakMemPct" by host

index=os sourcetype=Perfmon:LocalProcessor
| where like(counter,"% Processor Time")
| stats avg(Value) as "avgCpuPct", max(Value) as "peakCpuPct" by host

How to merge these two with out using JOIN. We can use OR.
I have tried
index=os source=Perfmon:LocalMainMemory OR sourcetype=Perfmon:LocalProcessor
| where like(counter,"% Committed Bytes In Use")
| where like(counter,"% Processor Time")
| stats avg(Value) as "avgMemPct", max(Value) as "peakMemPct" avg(Value1) as "avgCpuPct", max(Value1) as "peakCpuPct" by host

But is it not giving any value. Looks like I cannot use Value1. Can anyone help me!!

Re: merging two search strings

kristian_kolb — Mon, 14 Jan 2013 22:06:12 GMT

That will not work. The first 'where' will filter out all but events with 'committed bytes', and the second will filter out all events but those that have 'processor time'. which will be none.

Try doing something like this instead;

index=x sourcetype=y OR sourcetype=z counter="*Processor Time" OR counter = "*Committed bytes*" | stats avg(Value) max(Value) by counter, host

Hope this helps,

Kristian

Re: merging two search strings

Splunk_U — Mon, 14 Jan 2013 22:19:00 GMT

So is there no way of merging these two strings with OR..rght??

Re: merging two search strings

kristian_kolb — Tue, 15 Jan 2013 07:44:25 GMT

Did you even try the suggestion? How do you 'read' the search? What does it do? OR?

Re: merging two search strings

Splunk_U — Tue, 15 Jan 2013 13:35:16 GMT

I have also tried:
index=os source=Perfmon:LocalMainMemory OR sourcetype=Perfmon:LocalProcessor
| where like(counter,"% Committed Bytes In Use")
| eval CommittedBytes=Value
| where like(counter,"% Processor Time")
| eval ProcessorTime=Value
| stats avg(CommittedBytes) as "avgMemPct", max(CommittedBytes) as "peakMemPct" avg(ProcessorTime) as "avgCpuPct", max(ProcessorTime) as "peakCpuPct" by host but not working

Re: merging two search strings

Splunk_U — Tue, 15 Jan 2013 21:02:04 GMT

Kristian.. I have tried with your suggestion but it is giving the data in the format I want it to be. I need the data should come one row per host.It is not providing that

Re: merging two search strings

kristian_kolb — Tue, 15 Jan 2013 22:44:19 GMT

Then have a look at the chart command.

With 'chart blah blah over X by Y', you get the results on different axes.. axis? axises??