How to use join command to output in graph dashboard?

[jackin]

Hi,

I am using the below query to bring the output in graph dashboard but this query gives Disk memory values is same . I have attached the output also. Can anyone help me 

Query:

index=oswin sourcetype="Perfmon:Processor" host=COPYCAR01 
| timechart avg(cpu_load_percent) as CPU span=15min 
| join type=left host
[| mstats avg("Memory.%_Committed_Bytes_In_Use") as Memory WHERE index=oswinperf AND host=COPYCAR01 span=15min ] 
| join type=left host
[| mstats avg("LogicalDisk.%_Free_Space") as Diskfree WHERE index=oswinperf AND host=COPYCAR01 span=15min 
| eval DISK=100 - Diskfree 
| table _time,DISK]

Output:

_time               CPU                  DISK            Memory
2022-03-24 09:00:00 55.78524325650826 57.29944034187627 11.84846114177454
2022-03-24 09:15:00 59.38775699798989 57.29944034187627 11.84846114177454
2022-03-24 09:30:00 56.71582822628451 57.29944034187627 11.84846114177454

[diogofgm]

You are getting the same because you are joining by host and not by host/_time

Since you're getting already metrics data why not use CPU metrics data as well? That would make you search something like this:

| mstats avg("Processor.%_Processor_Time") AS CPU avg("Memory.%_Committed_Bytes_In_Use") as Memory avg("LogicalDisk.%_Free_Space") as Diskfree WHERE index=oswinperf AND host=COPYCAR01 span=15min 
| eval DISK=100 - Diskfree 
| table _time CPU Memory DISK

Way better since you do not need to use join.

[jackin]

Hi@diogofgm 

 Actually the cpu metric did not return the correct values. thats why

can you help me to bring the output?

[venky1544]

Hi @jackin 

what is the object and counter configured for you cpu metrics in your splunk and is your CPU data in sourcetype="Perfmon:Processor" i thought it is usually in different sourcetype 

like Memory.%_Committed_Bytes_In_Use  is for memory 

and LogicalDisk.%_Free_Space  is for free space 

[diogofgm]

In search and report ,in the analytics tab you can check which metrics you're collecting