Splunk : How can we get the combine result of cache and memory on splunk dashboard using splunk query

Question

I am trying to get combine results of cache and memory utilization on splunk dashboard using splunk query , can someone please help me with splunk query

Answer 1

Assuming cache and memory utilization are seperate queries, and there are values as cache_util and memory_util

there could be couple ways to achieve the same thing:

(index=cache cache_util=*) OR (index=memory memory_util=*) | eval util=coalesce(cache_util,memory_util)" | timechart avg(util) by host

another way index=cache cache_util=* | stats avg(cache_util) by host | appendcols [search index=memory memory_util=* | stats avg(memory_util) by host ]

if you can give some examples of your data or your search , better answer could be there.