Why am I getting an error on this timechart syntax when trying to display two curves?

[jip31]

Hello
I need help to display two curves in my chart and the 2 curves refer to host="$field1$ and host="$field2$
So I am trying to do an eval(avg(if(host="$field1$..... host="$field2$.... in timechart pipe
I also need a round number with 2 decimals of the field "PercentProcessorTime" but I always have errors.
Could you help me, please?

   index="windows-wmi" sourcetype="WMI:CPUload"  host="$field1$" (Name="mfetp/*" OR Name="mcshield/*") Name=$Service$  host="$field2$" (Name="mfetp/*" OR Name="mcshield/*") Name=$Service$ 
        | rex field=Name "^(?<Service>[^\/]+)[\/]" 

    | sort -_time 

    | rex field=Name "^(?<Service>[^\/]+)[\/]" 

    | sort -_time 
    |timechart span=10m avg(PercentProcessorTime) as PercentProcessorTime_AVG by Service

[niketn · Accepted solution]

@jip31, before we begin to look at your actual issue, some corrections
1) (Name="mfetp/*" OR Name="mcshield/*") Name=$Service$ in your base search are mentioned twice and have no effect on filtering results. You should have only one.
2) Following is mentioned twice in your search which seems copy paste error:

 | rex field=Name "^(?<Service>[^\/]+)[\/]" 
 | sort -_time

3) By defaults events are sorted in reverse chronological order and timechart should show them up properly without sort - _time. This seems to be just an overhead to your current query. Even if you need this for some other reason like working with streamstats then reverse is a better command.

Having said these can you share your current output and also what is the expected output? When you mentioned two curves by hosts what did you mean? Can you add a mock screenshot or table output of what is required?

Can you try the following to see if it works for you?

 index="windows-wmi" sourcetype="WMI:CPUload"  host="$field1$" (Name="mfetp/*" OR Name="mcshield/*") Name=$Service$
| rex field=Name "^(?<Service>[^\/]+)[\/]" 
| eval key=Service."-".host
| timechart span=10m avg(PercentProcessorTime) as PercentProcessorTime_AVG by key
| eval PercentProcessorTime_AVG =round(PercentProcessorTime_AVG,1)

[jip31]

hi 2 curves because I have 2 hosts: host="$field1$ and host="$field2$

i wrote this :
index="windows-wmi" sourcetype="WMI:CPUload" host="$field1$" (Name="mfetp/" OR Name="mcshield/") Name=$Service$
| rex field=Name "^(?[^\/]+)[\/]" | eval key=Service."-".host | timechart span=10m avg(PercentProcessorTime) as PercentProcessorTime_AVG, avg(PercentProcessorTime) as PercentProcessorTime_AVG by key | eval PercentProcessorTime_AVG =round(PercentProcessorTime_AVG,1)

Is it correct??
Is someone could give me another solution with eval(avg(if.... please??

[manish_singh_77]

Are you trying to display host information on graph, please elaborate, I did not get your question.