Searches
index=nix sourcetype=cpu host="host a" CPU="all" | eval Percent_CPU_Load = 100 - pctIdle | timechart limit=0 max(Percent_CPU_Load) by host
index=nix source=vmstat sourcetype=vmstat tag=memory host="host a" | timechart limit=0 max(memUsedPct) by host
Here is a simpler example of how this might work:
index=* | timechart count by source | append [search index=* | timechart count by sourcetype]
For your search this might work:
index=nix sourcetype=cpu host="host a" CPU="all" | eval Percent_CPU_Load = 100 - pctIdle | timechart limit=0 max(Percent_CPU_Load) by host | append [search index=nix source=vmstat sourcetype=vmstat tag=memory host="host a" | timechart limit=0 max(memUsedPct) by host]
It does not seem to work. It is displaying 3 charts instead of 2
Are you able to upload a picture so I can see what it looks like?
Thanks