Want to see data by host

[sunnyparmar]

Hi,

In the below given query i want to see the data by host but unable to see. Kindly suggest

index=sc-perfmon (counter="Avg. Disk sec/Read" OR counter="Avg. Disk sec/Write" ) by host | timechart avg(Value) by counter

Thanks
Ankit

[chimell · Accepted solution]

Hi sunnyparmar
Try this search code

|set union [search index=sc-perfmon counter="Avg. Disk sec/Read"| timechart avg(Value) by host] [ search index=sc-perfmon counter="Avg. Disk sec/Write" | timechart avg(Value) by host]

[sunnyparmar]

Hey,

thanks for the reply but it is given below error when I am running the below query

index=sc-perfmon (counter="Avg. Disk sec/Read" OR counter="Avg. Disk sec/Write" ) | set union [search index=sc-perfmon counter="Avg. Disk sec/Read"| timechart avg(Value) by host] [ search index=sc-perfmon counter="Avg. Disk sec/Write" | timechart avg(Value) by host]

ERROR

Error in 'set' command: This command must be the first command of a search.

Thanks & Regards
Sunny

[chimell]

Don't add something to the search code that i gave you just run it
it works well will my data
Delete index=sc-perfmon (counter="Avg. Disk sec/Read" OR counter="Avg. Disk sec/Write" ) and re-run

[chimell]

Note that the search which contain a set command always begin with | set

[sunnyparmar]

Ultimate.. it works...thanks once again

[chimell]

Good thanks

[stephane_cyrill]

HI TRY THIS

 index=sc-perfmon (counter="Avg. Disk sec/Read" OR counter="Avg. Disk sec/Write" )  | timechart avg(Value)  by host

[sunnyparmar]

Hey,

Thanks for the reply but if I did it by host only then query runs and it is showing data by host. Then when I will click on show events under it, it will show data for further parameter (Avg. Disk sec/Read and Avg. Disk sec/Write)but what I want that it will show data hostwise for both (counter="Avg. Disk sec/Read" OR counter="Avg. Disk sec/Write") counters in output.

and

Second query is not running.. it is giving an error.

Regards
Ankit