https://community.splunk.com/t5/Splunk-Search/how-do-you-concatenate-the-avg-value-for-perfmon-process-coming/m-p/330591#M98410 <P>Thanks for the quick response - I will preface this by saying thanks for your patience. The "by" statement does not seem to allow me to show the avg cpu for both servers on the same chart. When I use the timechart avg(Value) As Server1 I get the single value. When I use the by I get the same result with the null. My goal is to show server1 and server2 in a side by side comparison on the same chart with the appropriate tags. Is there some way of stratifying that formula, e.g timechart avg.server1(Value) As server 1 avg.server2(Value) as server2</P> Wed, 26 Jul 2017 12:37:50 GMT misnomerga 2017-07-26T12:37:50Z https://community.splunk.com/t5/Splunk-Search/how-do-you-concatenate-the-avg-value-for-perfmon-process-coming/m-p/330589#M98408 <P>Very new to Splunk and need some guidance. I believe there must be a way to index the servers to differentiate them somehow</P> <P>I have two servers with CPU processor time data coming in. How to display both values. The current query returns Error in 'timechart' command. The specifier 'avg(Value)' is specified multiple times and renamed with conflicting field names.</P> <P>The query is:</P> <P>sourcetype="Perfmon:Processor" | timechart avg(Value) As server1 avg(Value) As server2</P> Wed, 26 Jul 2017 11:37:26 GMT https://community.splunk.com/t5/Splunk-Search/how-do-you-concatenate-the-avg-value-for-perfmon-process-coming/m-p/330589#M98408 misnomerga 2017-07-26T11:37:26Z https://community.splunk.com/t5/Splunk-Search/how-do-you-concatenate-the-avg-value-for-perfmon-process-coming/m-p/330590#M98409 <P>The timechart command can separate stats values for you using the <CODE>by</CODE> clause. Something like this will give you a chart of average CPU processor time for each server.</P> <PRE><CODE>sourcetype="Perfmon:Processor" | timechart avg(Value) As AvgCPU by server </CODE></PRE> Wed, 26 Jul 2017 12:12:00 GMT https://community.splunk.com/t5/Splunk-Search/how-do-you-concatenate-the-avg-value-for-perfmon-process-coming/m-p/330590#M98409 richgalloway 2017-07-26T12:12:00Z https://community.splunk.com/t5/Splunk-Search/how-do-you-concatenate-the-avg-value-for-perfmon-process-coming/m-p/330591#M98410 <P>Thanks for the quick response - I will preface this by saying thanks for your patience. The "by" statement does not seem to allow me to show the avg cpu for both servers on the same chart. When I use the timechart avg(Value) As Server1 I get the single value. When I use the by I get the same result with the null. My goal is to show server1 and server2 in a side by side comparison on the same chart with the appropriate tags. Is there some way of stratifying that formula, e.g timechart avg.server1(Value) As server 1 avg.server2(Value) as server2</P> Wed, 26 Jul 2017 12:37:50 GMT https://community.splunk.com/t5/Splunk-Search/how-do-you-concatenate-the-avg-value-for-perfmon-process-coming/m-p/330591#M98410 misnomerga 2017-07-26T12:37:50Z https://community.splunk.com/t5/Splunk-Search/how-do-you-concatenate-the-avg-value-for-perfmon-process-coming/m-p/330592#M98411 <P>The timechart command I provided should work, but may need a little adjusting. In the 'by server' clause, 'server' is a field name that distinguishes server1 from server2. Your events probably use a different name. It may be 'host' or something else. Replace 'server' with the appropriate field name and see what you get.</P> Wed, 26 Jul 2017 12:50:11 GMT https://community.splunk.com/t5/Splunk-Search/how-do-you-concatenate-the-avg-value-for-perfmon-process-coming/m-p/330592#M98411 richgalloway 2017-07-26T12:50:11Z https://community.splunk.com/t5/Splunk-Search/how-do-you-concatenate-the-avg-value-for-perfmon-process-coming/m-p/330593#M98412 <P>THANK YOU - that additional piece did the trick</P> Wed, 26 Jul 2017 14:32:40 GMT https://community.splunk.com/t5/Splunk-Search/how-do-you-concatenate-the-avg-value-for-perfmon-process-coming/m-p/330593#M98412 misnomerga 2017-07-26T14:32:40Z