Splunk Search

How to create a single chart showing % Processor Time and % User Time by host?

CSMounsey01
New Member

I'm trying to create a single chart showing % Processor Time and % User Time by host

My example so far:

host="pvawbdap01.ifdsgroup.co.uk" index="bluedoor_registry_perfmon"  source="Perfmon:Processor" | stats avg("% Processor Time") as hRs, avg("% User Time") as ssns by _time,source | eval s1=("% Processor Time % User Time") | makemv s1 | mvexpand s1 | eval yval=case(s1==("% Processor Time"),hRs,s1==("% User Time"),ssns) | eval series=source+":"+s1 | xyseries _time,series,yval
0 Karma

lguinn2
Legend

Would this work?

 host="pvawbdap01.ifdsgroup.co.uk" index="bluedoor_registry_perfmon"
      source="Perfmon:Processor"
 | stats avg("% Processor Time") as hRs, avg("% User Time") as ssns by source
0 Karma
Get Updates on the Splunk Community!

Data Management Digest – December 2025

Welcome to the December edition of Data Management Digest! As we continue our journey of data innovation, the ...

Index This | What is broken 80% of the time by February?

December 2025 Edition   Hayyy Splunk Education Enthusiasts and the Eternally Curious!    We’re back with this ...

Unlock Faster Time-to-Value on Edge and Ingest Processor with New SPL2 Pipeline ...

Hello Splunk Community,   We're thrilled to share an exciting update that will help you manage your data more ...