Splunk Search

How to display Linux and Windows CPU perf in one timechart other than appendcols method?

New Member

Currently I am using appendcols method, it seems work, but once the first search returns no result, the timechart will not show the subsearch results, my script is as below, it's just joining up the scripts in app nix and windows with appendcols, is there any solution for this issue?

sourcetype=WMI:CPUTime host=$host$
| timechart avg(PercentProcessorTime) by host
| appendcols [ search sourcetype=cpu host=$host$
| multikv fields pctIdle
| eval PercentCPULoad = 100 - pctIdle
| timechart avg(PercentCPULoad) by host ]

Tags (2)
0 Karma


Hi rogner
Try this search code

    |multisearch [ sourcetype="WMI:CPUTime" host=$host$| timechart avg(PercentProcessorTime) as WMI_avg by host |return $WMI_avg] [ search sourcetype=cpu host=$host$| multikv fields pctIdle| eval Percent_CPU_Load = 100 - pctIdle| timechart avg(Percent_CPU_Load) as unix_avg by host |return $unix_avg ] 
0 Karma

Esteemed Legend

Don't use subsearch; try this:

host=$host$ (sourcetype=WMI:CPUTime OR sourcetype=cpu) | multikv fields pctIdle | eval Percent_CPU_Load = 100 - pctIdle | timechart avg(Percent_CPU_Load) avg(PercentProcessorTime) BY host
0 Karma