Archive
Highlighted

how to use UNION for 4 counter types

Communicator

Hi,

I have 4 counters with the following name for the performance monitor of the system-

1.) Avg. Disk sec/Read
2.) Avg. Disk sec/Write
3.) Disk Reads/sec
4.) Disk Writes/sec

I want to see all above counters in one query in either bars or graphs so for that I am making my query like given below but it is not working. Kindly suggest where I am doing wrong?

|set union [search index=sc-perfmon counter="Avg. Disk sec/Read"| timechart avg(Value) by host] [ search index=sc-perfmon counter="Avg. Disk sec/Write" | timechart avg(Value) by host] [search index=sc-perfmon counter="Disk Reads/sec" | timechart avg(Value) by host] [search index=sc-perfmon counter="Disk Writes/sec" | timechart avg(Value) by host]

Thanks
Ankit

Tags (2)
0 Karma
Highlighted

Re: how to use UNION for 4 counter types

Communicator

Can you try 'append' and check if it works.
|set union [search index=sc-perfmon counter="Avg. Disk sec/Read"| timechart avg(Value) by host] [ append search index=sc-perfmon counter="Avg. Disk sec/Write" | timechart avg(Value) by host] [ append search index=sc-perfmon counter="Disk Reads/sec" | timechart avg(Value) by host] [ append search index=sc-perfmon counter="Disk Writes/sec" | timechart avg(Value) by host]

View solution in original post

Highlighted

Re: how to use UNION for 4 counter types

Communicator

Just append and not append

0 Karma
Highlighted

Re: how to use UNION for 4 counter types

Communicator

Thanks for the reply..I have tried but it is giving below error ..

Error in 'append' command: The last argument must be a subsearch.

0 Karma
Highlighted

Re: how to use UNION for 4 counter types

Communicator

Can you try - remove 'union' and use 'append'.

0 Karma
Highlighted

Re: how to use UNION for 4 counter types

Communicator

After removing of union is it the right format for the command given below?

[append search index=sc-perfmon counter="Avg. Disk sec/Read"| timechart avg(Value) by host] [ append search index=sc-perfmon counter="Avg. Disk sec/Write" | timechart avg(Value) by host]
[append search index=sc-perfmon counter="Disk Reads/sec" | timechart avg(Value) by host] [append search index=sc-perfmon counter="Disk Writes/sec" | timechart avg(Value) by host]

0 Karma
Highlighted

Re: how to use UNION for 4 counter types

Communicator

[search index=sc-perfmon counter="Avg. Disk sec/Read"| timechart avg(Value) by host] append [search index=sc-perfmon counter="Avg. Disk sec/Write" | timechart avg(Value) by host]
append [search index=sc-perfmon counter="Disk Reads/sec" | timechart avg(Value) by host] append [search index=sc-perfmon counter="Disk Writes/sec" | timechart avg(Value) by host]

0 Karma
Highlighted

Re: how to use UNION for 4 counter types

Communicator

Thanks for replying but it is showing no result found 😞

0 Karma
Highlighted

Re: how to use UNION for 4 counter types

Communicator

When I am running these counters in separate queries then it is showing result. Queries are -

1.) index=sc-perfmon (counter="Avg. Disk sec/Read" OR counter="Avg. Disk sec/Write" ) host=BWIN7136 | timechart avg(Value) by counter

2.) index=sc-perfmon (counter="Disk Reads/sec" OR counter="Disk Writes/sec" ) host=BWIN7136 | timechart avg(Value) by counter

0 Karma
Highlighted

Re: how to use UNION for 4 counter types

Communicator

Sorry. My mistake. Can you please try using appendcols, instead of append and I hope it works.

0 Karma