Multisearch to display Average % CPU Used by Process by Hosts for both linux and windows servers

[johnward4]

I've trying to create a multisearch that displays the Average % CPU Used by Process by Hosts for both Linux and Windows Servers. My Linux query works great but I'm having issues outputting the same for my Windows query. Please help!
Here's my current query :

| multisearch
[ search (index=os host=hostname* source=ps) process_name!="-bash"| stats avg(process_cpu_used_percent) AS avgCPUUsed by process_name, host | where avgCPUUsed > 50 | rename avgCPUUsed AS "% CPU Used by Process" | rename process_name as "Process Name" | sort - "% CPU Used by Process"]
[ search (index=perfmon host=hostname* (source="Perfmon:Process") counter="% Processor Time" (instance!="_Total" AND instance!="Idle" AND instance!="System") | eventstats avg(Value) as AvgValue by host,instance | where AvgValue > 50 | sort -AvgValue]

[johnward4 · Accepted solution]

Here's how to display CPU load across OS (linux, windows)

|multisearch
[search index=os host=$Hosts$ sourcetype=cpu cpu="all" |eval cpu_used_percent=100-PercentIdleTime]
[search index=perfmon host=$Hosts$ source="Perfmon:CPU" counter="% User Time" OR counter="% Processor Time"
|eval cpu_user_percent=if(counter=="% User Time",round(Value,2),""), cpu_load_percent=if(counter=="% Processor Time",round(Value),""), cpu_used_percent=user_cpu+proc_cpu]
|eval lhost=upper(host)
|bin _time span=10m
|stats avg(cpu_user_percent) as user_cpu, avg(cpu_load_percent) as proc_cpu by host, _time
|stats last(user_cpu) as user_cpu, last(proc_cpu) as proc_cpu, sparkline(avg(user_cpu)) as "% User CPU Load", sparkline(avg(proc_cpu)) as "% Processor CPU Load" by host
|eval user_cpu=round(user_cpu,2), proc_cpu=round(proc_cpu,2)
|rename user_cpu as "% Current User CPU Load", proc_cpu as "% Current Processor Load"
| sort - "% Current User CPU Load"