merging two search strings

[Splunk_U]

I have two search string:
index=os source=Perfmon:LocalMainMemory
| where like(counter,"% Committed Bytes In Use")
| stats avg(Value) as "avgMemPct", max(Value) as "peakMemPct" by host

index=os sourcetype=Perfmon:LocalProcessor
| where like(counter,"% Processor Time")
| stats avg(Value) as "avgCpuPct", max(Value) as "peakCpuPct" by host

How to merge these two with out using JOIN. We can use OR.
I have tried
index=os source=Perfmon:LocalMainMemory OR sourcetype=Perfmon:LocalProcessor
| where like(counter,"% Committed Bytes In Use")
| where like(counter,"% Processor Time")
| stats avg(Value) as "avgMemPct", max(Value) as "peakMemPct" avg(Value1) as "avgCpuPct", max(Value1) as "peakCpuPct" by host

But is it not giving any value. Looks like I cannot use Value1. Can anyone help me!!

[kristian_kolb]

That will not work. The first 'where' will filter out all but events with 'committed bytes', and the second will filter out all events but those that have 'processor time'. which will be none.

Try doing something like this instead;

index=x sourcetype=y OR sourcetype=z counter="*Processor Time" OR counter = "*Committed bytes*" | stats avg(Value) max(Value) by counter, host

Hope this helps,

Kristian

[kristian_kolb]

Then have a look at the chart command.

With 'chart blah blah over X by Y', you get the results on different axes.. axis? axises??

[Splunk_U]

Kristian.. I have tried with your suggestion but it is giving the data in the format I want it to be. I need the data should come one row per host.It is not providing that

[Splunk_U]

I have also tried:
index=os source=Perfmon:LocalMainMemory OR sourcetype=Perfmon:LocalProcessor
| where like(counter,"% Committed Bytes In Use")
| eval CommittedBytes=Value
| where like(counter,"% Processor Time")
| eval ProcessorTime=Value
| stats avg(CommittedBytes) as "avgMemPct", max(CommittedBytes) as "peakMemPct" avg(ProcessorTime) as "avgCpuPct", max(ProcessorTime) as "peakCpuPct" by host but not working

[kristian_kolb]

Did you even try the suggestion? How do you 'read' the search? What does it do? OR?

[Splunk_U]

So is there no way of merging these two strings with OR..rght??