Perfmon Timechart - Multiple Series, Multiple Host

[seanp]

I have been struggling to find the proper syntax for this type of timechart. This relates to creating a Windows PerfMon graph for multiple series (in the same counter) and multiple host to be able to easily compare. For example, I can graph Bytes Received/sec and Bytes Sent/sec with a simple search like:

index=MyIndex object="Network Interface" | timechart span=30min avg(Value) by counter

This provides gives the total for both host. Now I want to essentially add by host to the end of by counter. Any thoughts? Is this a multi-valued field???

[somesoni2]

Give this a try

index=MyIndex object="Network Interface" |bucket _time span=30m | eval host=_time."##".host|chart avg(Value) over host by counter | rex field=host "(?<_time>.*)##(?<host>.*)"

[linu1988]

Try Chart instead of timechart

|bucket _time span=30m|chart avg(Value) by _time,counter,host

|bucket _time span=30m|chart avg(Value) over host by counter

have not tried it myself but this is the way to go. Check out chart overlay in the documentation

Thanks,
L