how to use UNION for 4 counter types

[sunnyparmar]

Hi,

I have 4 counters with the following name for the performance monitor of the system-

1.) Avg. Disk sec/Read
2.) Avg. Disk sec/Write
3.) Disk Reads/sec
4.) Disk Writes/sec

I want to see all above counters in one query in either bars or graphs so for that I am making my query like given below but it is not working. Kindly suggest where I am doing wrong?

|set union [search index=sc-perfmon counter="Avg. Disk sec/Read"| timechart avg(Value) by host] [ search index=sc-perfmon counter="Avg. Disk sec/Write" | timechart avg(Value) by host] [search index=sc-perfmon counter="Disk Reads/sec" | timechart avg(Value) by host] [search index=sc-perfmon counter="Disk Writes/sec" | timechart avg(Value) by host]

Thanks
Ankit

[vinitatsky · Accepted solution]

Can you try 'append' and check if it works.
|set union [search index=sc-perfmon counter="Avg. Disk sec/Read"| timechart avg(Value) by host] [ append search index=sc-perfmon counter="Avg. Disk sec/Write" | timechart avg(Value) by host] [ append search index=sc-perfmon counter="Disk Reads/sec" | timechart avg(Value) by host] [ append search index=sc-perfmon counter="Disk Writes/sec" | timechart avg(Value) by host]

[vinitatsky]

Just append and not append

[sunnyparmar]

Thanks for the reply..I have tried but it is giving below error ..

Error in 'append' command: The last argument must be a subsearch.

[vinitatsky]

Can you try - remove 'union' and use 'append'.

[sunnyparmar]

After removing of union is it the right format for the command given below?

[append search index=sc-perfmon counter="Avg. Disk sec/Read"| timechart avg(Value) by host] [ append search index=sc-perfmon counter="Avg. Disk sec/Write" | timechart avg(Value) by host]
[append search index=sc-perfmon counter="Disk Reads/sec" | timechart avg(Value) by host] [append search index=sc-perfmon counter="Disk Writes/sec" | timechart avg(Value) by host]

[vinitatsky]

[search index=sc-perfmon counter="Avg. Disk sec/Read"| timechart avg(Value) by host] append [search index=sc-perfmon counter="Avg. Disk sec/Write" | timechart avg(Value) by host]
append [search index=sc-perfmon counter="Disk Reads/sec" | timechart avg(Value) by host] append [search index=sc-perfmon counter="Disk Writes/sec" | timechart avg(Value) by host]

[sunnyparmar]

Thanks for replying but it is showing no result found 😞

[sunnyparmar]

When I am running these counters in separate queries then it is showing result. Queries are -

1.) index=sc-perfmon (counter="Avg. Disk sec/Read" OR counter="Avg. Disk sec/Write" ) host=BWIN7136 | timechart avg(Value) by counter

2.) index=sc-perfmon (counter="Disk Reads/sec" OR counter="Disk Writes/sec" ) host=BWIN7136 | timechart avg(Value) by counter

[vinitatsky]

Sorry. My mistake. Can you please try using appendcols, instead of append and I hope it works.

[sunnyparmar]

still showing the same result (no result found)..

[vinitatsky]

index=sc-perfmon counter="Avg. Disk sec/Read" OR counter="Avg. Disk sec/Write" OR counter="Disk Reads/sec" OR counter="Disk Writes/sec" | chart avg(Value) over _time by counter

[sunnyparmar]

it works.. thanks a lot...