Compare values from multiple Data Inputs

[achudnoff]

I'm trying to write a search that will compare values from different data inputs and return the highest value to use as a rangemap. The values are cpu usage, memory usage, disk read percentage and write percentage. CPU, memory and Disk IO come from different data inputs. When I use the search below, it build the table I want, but the different inputs show up on different rows, so the compare doesn't function properly. My search is:

index="rws_wmi" ComputerName=csiadrws01 |
eval cpu=PercentProcessorTime |
eval mem=PercentCommittedBytesInUse |
eval read=PercentDiskReadTime |
eval write=PercentDiskWriteTime |
eval health=max(cpu, mem, read, write) |
rangemap field=health low=0-50 elevated=51-80 severe=81-100 |
table cpu mem read write health range

Any advice would be great.

[lguinn2 · Accepted solution]

Try this instead

index="rws_wmi" ComputerName=csiadrws01 |
stats max(PercentProcessorTime) as cpu max(PercentCommittedBytesInUse) as mem
        max(PercentDiskReadTime) as read max(PercentDiskWriteTime) as write |
eval health=max(cpu, mem, read, write) |
rangemap field=health low=0-50 elevated=51-80 severe=81-100 

I don't really understand the health field, but I still think this will work. If it doesn't, try running the command without the eval and rangemap, just to see what you get back. Note that the spacing is just for readability.

[achudnoff]

This looks like exactly what I wanted. Thanks so much!