Need help on timechart with value

[jackin]

Hi,

Here's my query -

| mstats max(_value) avg(_value) min(_value) prestats=true WHERE metric_name="cpu.system" AND"index"="osnixperf" AND 
[| inputlookup Unix.csv] BY host span=1h 
| stats Avg(_value) AS Avg1 BY host 
| join 
[| mstats max(_value) avg(_value) min(_value) prestats=true WHERE metric_name="cpu.user" AND"index"="osnixperf" AND 
[| inputlookup Unix.csv] BY host span=1h 
| stats Avg(_value) AS Avg2 BY host] 
| eval totalavg=Avg1+Avg2,totalavg=round(totalavg,2)

I need the timechart that shows with totalavg value like below image. 

jackin_0-1635926340469.png

[ITWhisperer]

Your stats commands are removing the time element from your results - try something like this

| mstats max(_value) avg(_value) AS Avg1 min(_value) prestats=true WHERE metric_name="cpu.system" AND"index"="osnixperf" AND 
[| inputlookup Unix.csv] BY host span=1h 
| join 
[| mstats max(_value) avg(_value) AS Avg2 min(_value) prestats=true WHERE metric_name="cpu.user" AND"index"="osnixperf" AND 
[| inputlookup Unix.csv] BY host span=1h 
| eval totalavg=Avg1+Avg2,totalavg=round(totalavg,2)

[jackin]

@ITWhisperer Hi,

Its looks as working but but it not showing any values and error msg's
can you give me any suggestions to my query OR can you help any different way to calculate the  2 metrics.

[ITWhisperer]

OK start with the first mstats - does this give you what you expect from just that index?

Then try the second mstats separately - does this give you what you expect from just that index?