Sorry for answering this late. I think i misexplained, i just assumed that ProcessName is related to the services running and cpu_load_percent is the percentage of cpu used. And even if they are not related, they certainly vary over time. So i want to make my chart not to be a timechart and show the two fields. Thank you in advance. Also if the fields i am using are not correct tell me
First, verify you are receiving events with the cpu_load_percent field in them. That the count of the field is zero implies you do not have the data.
Second, you probably don't want the count function because the counting the number of instances of this field is not as useful as knowing the value of the field. Perhaps max(cpu_load_percent) would be better.
i receive events when i do separates searchs, one with cpu_load_percent, and the other with processName, but not with both fields, and this is what i get when i dont add the count function:
Before you can graph the relationship between processName and cpu_load_percent you must first establish such a relationship. The two searches that return the separate fields need to be combined so you have both fields in the results. Share the searches and we can help you put them together.
search for cpu_load_percent
index=perfmon cpu_load_percent=*
search for ProcessName
index=perfmon ProcessName
That's not much to work with. What links a processName to its cpu_load_percent?
The variation of the cpu depends on the process running. its like when i open the windows task manager, it show the process which is running and the percentage of cpu used. I want to make a chart of all the process running and the percentage of cpu used. Hope i explained it correctly.
Splunk is not looking at the Task Manager. It has two searches with two different and distinct fields and nothing to link them. Check your data to see if there are other fields that can be used to associate a processName with its cpu_load_percent.
Please elaborate on "it doesn't work". What results did you get and how did they not meet expectations?
this is what i get when i do the search, the value of cpu_user_percent is equal to zero, which is not normal but i its because the fields are not compatibles. I apologize for my bad english