thank you, that's a much cleaner form for the search, but how would I go about adding the read, write, and transfers for each host?  ... View more

Sorry about that, the content of the search is this (changed index and host names): | mstats avg(_value) prestats=true WHERE metric_name="logicaldisk.disk_writes/sec" AND index="indexname" AND host="host*" span=10s BY host | timechart avg(_value) span=10s agg=max limit=5 useother=false BY host | fields - _span* | rename * AS "* - logicaldisk.disk_writes/sec" | rename "_time - logicaldisk.disk_writes/sec" AS _time | append [ | mstats avg(_value) prestats=true WHERE metric_name="logicaldisk.disk_reads/sec" AND index="indexname" AND host="host*" span=10s BY host | timechart avg(_value) span=10s agg=max limit=5 useother=false BY host | fields - _span* | rename * AS "* - logicaldisk.disk_reads/sec" | rename "_time - logicaldisk.disk_reads/sec" AS _time ] | selfjoin keepsingle=true _time | append [ | mstats avg(_value) prestats=true WHERE metric_name="logicaldisk.disk_transfers/sec" AND index="indexname" AND host="host*" span=10s BY host | timechart avg(_value) span=10s agg=max limit=5 useother=false BY host | fields - _span* | rename * AS "* - logicaldisk.disk_transfers/sec" | rename "_time - logicaldisk.disk_transfers/sec" AS _time ] | selfjoin keepsingle=true _time The original graphs were grabbed from the Analytics tab next to search, shows the reads, writes, and transfers per second for each of 4 hosts. I'd like to add the values obtained from each of the three graphs and have one graph with 4 lines showing the sums of the information for each server. The statistics table is mostly empty, left most column lists the times. There are 12 columns, each named one of the 4 hosts, followed by read/write/transfer per second. The rows only have 3 values in each, just the amount of reads/writes/transfers at that time for a specific host. Is that enough info? ... View more