How to display Linux and Windows CPU perf in one timechart other than appendcols method?

[rogner]

Currently I am using appendcols method, it seems work, but once the first search returns no result, the timechart will not show the subsearch results, my script is as below, it's just joining up the scripts in app nix and windows with appendcols, is there any solution for this issue?

sourcetype=WMI:CPUTime host=$host$
| timechart avg(PercentProcessorTime) by host
| appendcols [ search sourcetype=cpu host=$host$
| multikv fields pctIdle
| eval Percent_CPU_Load = 100 - pctIdle
| timechart avg(Percent_CPU_Load) by host ]

[chimell]

Hi rogner
Try this search code

    |multisearch [ sourcetype="WMI:CPUTime" host=$host$| timechart avg(PercentProcessorTime) as WMI_avg by host |return $WMI_avg] [ search sourcetype=cpu host=$host$| multikv fields pctIdle| eval Percent_CPU_Load = 100 - pctIdle| timechart avg(Percent_CPU_Load) as unix_avg by host |return $unix_avg ] 

[woodcock]

Don't use subsearch; try this:

host=$host$ (sourcetype=WMI:CPUTime OR sourcetype=cpu) | multikv fields pctIdle | eval Percent_CPU_Load = 100 - pctIdle | timechart avg(Percent_CPU_Load) avg(PercentProcessorTime) BY host