Chart of multiple sourcetypes

[avitallange]

Hi,

I would like to get a line chart in which I can see a line for each trace level (verbose, info, warning, error).
In addition I'd like to see on the same chart another line for the CPU Usage.
It would let me know if errors are related to high CPU usage.

We have a sourcetype called "Trace" that contains the field "tracelevel".
And we have a sourcetype called "CpuLoad" that contains the fields "Value" and "Counter".
The "Counter" can be "ProcessorTime" or "UserTime".

I tried to combine the 2 queries into one line chart:

1. sourcetype="Trace" | timechart count by tracelevel
2. sourcetype="CpuLoad" Counter="ProcessorTime" | timechart avg(Value)

But I couldn't make it work.

Could you please assist?

[cramasta]

You could probably do this without a join but its friday and my brain has shut down.

sourcetype="Trace" | timechart span=15m count by tracelevel | join type=left _time [search sourcetype="CpuLoad" Counter="ProcessorTime" | timechart span=15m avg(Value) AS avgValue]

[avitallange]

Thank you!