How to write search for timechart with multiple joins?

[Karthikeyan]

Hello,

I am trying to write a search query to fetch data from different sourcetype and the common factor in all sorucetype is _time.

I'm facing two issues.

1. With below search criteria, the value of field CPU is constant all the time, but the actual value is different.

index=indexname host=hostname sourcetype=meminfo earliest=-1d@d latest=@d
| table memUsedPct
| join type=inner _time [search index=indexname host=hostname sourcetype=cpuinfo | multikv | search CPU=all | eval CPU=100-pctIdle | table CPU]

2. How to show the memUsedPct and CPU in a timechart ?

Regards, Karthikeyan

[somesoni2]

There is no need for join. Try like this

index=indexname host=hostname (sourcetype=meminfo OR sourcetype=cpuinfo) earliest=-1d@d latest=@d
| multikv | search CPU=all OR memUsedPct=* | eval CPU=100-pctIdle
| fields _time memUsedPct CPU
| timechart avg(*) as *