How to make multiple searches combine into a table?

[Russ]

Disclaimer - Fairly New to Splunk

I'm stuck on building a table for a dashboard.
I would like to list a table of Computer Names with columns displaying the last 5min average values for CPU% / Mem% / DiskTransfers / etc

The search is 

index=azure sourcetype="mscs:azure:eventhub:vmmetrics" body.Computer=* body.ObjectName="Processor" 
| stats first(body.CounterValue) by body.Computer

That gives me the last Processor value for each Computer. (I cant do 5min average - that can be a bonus point answer !)

How would I add the same search into the table but with replacing the body.ObjectName field value for
body.ObjectName="Memory" 
and then 
body.ObjectName="DiskTransfers" 

and then combine that into one table .

Thanks for helping 🙂

[Russ]

Thanks for the reply - yes - that's going the right way. I appreciate that  answering questions, when you cant see the data is best effort.

That does produce a table ('body.objectname' has become 'body.CounterName') as you can see.

index=azure sourcetype="mscs:azure:eventhub:vmmetrics" body.Computer=* (body.CounterName="% Processor Time" OR body.CounterName="% Committed Bytes In Use" OR body.CounterName="Disk Transfers/sec")
| eval CounterValue=round('body.CounterValue',0)
| stats first(CounterValue) by body.Computer body.CounterName

DO you know how I would get the body.CounterName fields to be the column headers?

Computername	CPU%	MEM%	DiskRate
Comp1	3	45	34
Comp2	5	56	2

etc

Do you join up multiple searches or perhaps transpose or can you do a Stats field by field by field?

[bowesmana · Accepted solution]

Use chart instead of stats

| chart first(CounterValue) over body.Computer by body.CounterName

[Russ]

Yes - chart did the trick! Thanks

[ITWhisperer]

Without the benefit of seeing your events data, try something like this:

index=azure sourcetype="mscs:azure:eventhub:vmmetrics" body.Computer=* (body.ObjectName="Processor" OR body.ObjectName="Memory" OR body.ObjectName="DiskTransfers")
| stats first(body.CounterValue) by body.Computer body.ObjectName