Splunk Query not generating proper output

[shreyasathavale]

Hi,
We have joined 2 queries for output.When we run individual query we are getting the proper output but when combined we are not getting it. It would be helpful if anyone give thoughts about it.
Queries are as follows:

index=perfmon counter="% Processor Time" source="Perfmon:cputime" earliest=-15m | stats avg(Value) as CpuUsage by role,host|where CpuUsage > 10

index=perfmon counter="% Processor Time"source="Perfmon:Process" | top 6 instance by host|fields instance,host

[shreyasathavale]

I have mentioned roles in serverclass.conf

[linu1988]

I have 2 doubts

| stats avg(Value) as CpuUsage by role,host 

from where u are getting roles?

[HiroshiSatoh]

Do you join? Not add?

[join]
index=perfmon counter="% Processor Time" source="Perfmon:cputime" earliest=-15m | stats avg(Value) as CpuUsage by role,host|where CpuUsage > 10 |join host [index=perfmon counter="% Processor Time"source="Perfmon:Process" | top 6 instance by host|fields instance,host]

[ADD]
index=perfmon counter="% Processor Time" source="Perfmon:cputime" earliest=-15m | stats avg(Value) as CpuUsage by role,host|where CpuUsage > 10 |append [index=perfmon counter="% Processor Time"source="Perfmon:Process" | top 6 instance by host|fields instance,host]

[shreyasathavale]

Hi, I tried the above queries but it is only giving me top 1 instance instead of 3/4/5 .. My requirement is "If the 1st query is true then only run 2nd query else dont run" , since it takes lots of time for parsing.. Any help ??

[shreyasathavale]

I had used appendcols as well as join but was not able to get the output... I had tried join id [search index=]...I will still try the above .. Thanks..