Windows_process_cpu_time_total with join producing odd results

I’m trying to solve naming of processes we monitor to something human readable.

Best solution so far has been to join with windows_process_cpu_time_total and windows_service_info

sum((rate(windows_process_cpu_time_total{job=~"<jobs>"}[1m])) 
* on(instance, process_id) group_left(name, display_name, run_as) 
windows_service_info{display_name=~"<service_we_care_about>",job=~"<jobs>"}) 
without (mode,process_id)

Compared to the query we are replacing the graph has dead areas. I presume this is some multiplyer issue when the cpu time is some very small number?

Expected to look as graph did without the join. Previously running a forked windows_exporter that did the renaming of process to the name of the display_name of service.

original


with the join