How to use different 'object' and 'counter' of perfmon in one search ?

[henriq_c]

Hi,

I want to do a table using the eventtype 'perfmon_windows' but I want to see the Value of "% Free Space" and also the Value of "Committed Bytes" of my host. How can I see the value of both in a table ?

object="Memory" counter="Committed Bytes"
object="LogicalDisk" counter="% Free Space"

How to take the different values of each counter ? Because both have the name Value...

Thank you

[davpx]

Quick and dirty example of the average of both over time.

sourcetype=Perfmon* (object="Memory" counter="Committed Bytes") OR (object="LogicalDisk" counter="% Free Space") 
|  timechart avg(Value) as Value by counter

[henriq_c]

I want for exemple the value of % Free Space in a column, Committed Bytes in another, % Comitted in another, etc of each servers...
exemple :
server instance Free Space % RAM %
server1 C: 8 30
server2 😧 36 24
...

[adonio]

like this?

index = perfmon (object="Memory" counter="Committed Bytes") OR (object="LogicalDisk" counter="% Free Space")
| bin span=5m _time
| stats avg(Value) as avg_value by object counter host 

[henriq_c]

I want for exemple the value of % Free Space in a column, Committed Bytes in another, % Comitted in another, of each serversetc...
exemple :
server instance Free Space % RAM %
server1 C: 8 30
server2 😧 36 24