how do you concatenate the avg(value) for perfmon process coming from two servers

[misnomerga]

Very new to Splunk and need some guidance. I believe there must be a way to index the servers to differentiate them somehow

I have two servers with CPU processor time data coming in. How to display both values. The current query returns Error in 'timechart' command. The specifier 'avg(Value)' is specified multiple times and renamed with conflicting field names.

The query is:

sourcetype="Perfmon:Processor" | timechart avg(Value) As server1 avg(Value) As server2

[misnomerga]

THANK YOU - that additional piece did the trick

[richgalloway · Accepted solution]

The timechart command can separate stats values for you using the by clause. Something like this will give you a chart of average CPU processor time for each server.

sourcetype="Perfmon:Processor" | timechart avg(Value) As AvgCPU by server

[misnomerga]

Thanks for the quick response - I will preface this by saying thanks for your patience. The "by" statement does not seem to allow me to show the avg cpu for both servers on the same chart. When I use the timechart avg(Value) As Server1 I get the single value. When I use the by I get the same result with the null. My goal is to show server1 and server2 in a side by side comparison on the same chart with the appropriate tags. Is there some way of stratifying that formula, e.g timechart avg.server1(Value) As server 1 avg.server2(Value) as server2

[richgalloway]

The timechart command I provided should work, but may need a little adjusting. In the 'by server' clause, 'server' is a field name that distinguishes server1 from server2. Your events probably use a different name. It may be 'host' or something else. Replace 'server' with the appropriate field name and see what you get.