https://community.splunk.com/t5/Dashboards-Visualizations/Splunk-Query/m-p/516315#M34550 <P>Hi ,</P><P>Below is the existing query but when i run this for a single index&nbsp; with its fields i get the&nbsp; statistics data &amp; count but when&nbsp; i am trying to run all these 4 -indexes and it's respective fields together i am not&nbsp; getting any Statistical table as output what changes do i need to make to list out all 4 indexes with their respective count in statistics. ..(For single index and it's fields it's working fine but when i try to merge all 4 index details it's statistics value is 0 as you can see below.)</P><P><span class="lia-inline-image-display-wrapper lia-image-align-inline" image-alt="bapun18_0-1598459013104.png" style="width: 999px;"><img src="https://community.splunk.com/t5/image/serverpage/image-id/10525i8A8AEBAC880D88F3/image-size/large?v=v2&amp;px=999" role="button" title="bapun18_0-1598459013104.png" alt="bapun18_0-1598459013104.png" /></span></P><P>&nbsp;</P> Wed, 26 Aug 2020 16:30:56 GMT bapun18 2020-08-26T16:30:56Z https://community.splunk.com/t5/Dashboards-Visualizations/Splunk-Query/m-p/516315#M34550 <P>Hi ,</P><P>Below is the existing query but when i run this for a single index&nbsp; with its fields i get the&nbsp; statistics data &amp; count but when&nbsp; i am trying to run all these 4 -indexes and it's respective fields together i am not&nbsp; getting any Statistical table as output what changes do i need to make to list out all 4 indexes with their respective count in statistics. ..(For single index and it's fields it's working fine but when i try to merge all 4 index details it's statistics value is 0 as you can see below.)</P><P><span class="lia-inline-image-display-wrapper lia-image-align-inline" image-alt="bapun18_0-1598459013104.png" style="width: 999px;"><img src="https://community.splunk.com/t5/image/serverpage/image-id/10525i8A8AEBAC880D88F3/image-size/large?v=v2&amp;px=999" role="button" title="bapun18_0-1598459013104.png" alt="bapun18_0-1598459013104.png" /></span></P><P>&nbsp;</P> Wed, 26 Aug 2020 16:30:56 GMT https://community.splunk.com/t5/Dashboards-Visualizations/Splunk-Query/m-p/516315#M34550 bapun18 2020-08-26T16:30:56Z https://community.splunk.com/t5/Dashboards-Visualizations/Splunk-Query/m-p/516341#M34551 <P>You should use (index....) OR (index....) ... otherwise your logic could be wron as you have ORs and ANDs in your base query.</P><P>r. Ismo</P> Wed, 26 Aug 2020 18:14:13 GMT https://community.splunk.com/t5/Dashboards-Visualizations/Splunk-Query/m-p/516341#M34551 isoutamo 2020-08-26T18:14:13Z