topic How to combine chart count for two fields in one search in Splunk Search https://community.splunk.com/t5/Splunk-Search/How-to-combine-chart-count-for-two-fields-in-one-search/m-p/426654#M122244 <P>Hi,</P> <P>Can any one help me adding two fields in one search I am seeing both fields in splunk selected fields but not seeing new field in Search result.</P> <PRE><CODE>Query : Basic Search AND body.response.failedUpcName=* OR body.failedUpcName=* | chart count by body.response.failedUpcName , body.failedUpcName Old Field Name : body.response.failedUpcName New Field Name : body.failedUpcName </CODE></PRE> <P>How to get results for both Fields ?</P> Sun, 04 Aug 2019 04:44:08 GMT monipinni 2019-08-04T04:44:08Z How to combine chart count for two fields in one search https://community.splunk.com/t5/Splunk-Search/How-to-combine-chart-count-for-two-fields-in-one-search/m-p/426654#M122244 <P>Hi,</P> <P>Can any one help me adding two fields in one search I am seeing both fields in splunk selected fields but not seeing new field in Search result.</P> <PRE><CODE>Query : Basic Search AND body.response.failedUpcName=* OR body.failedUpcName=* | chart count by body.response.failedUpcName , body.failedUpcName Old Field Name : body.response.failedUpcName New Field Name : body.failedUpcName </CODE></PRE> <P>How to get results for both Fields ?</P> Sun, 04 Aug 2019 04:44:08 GMT https://community.splunk.com/t5/Splunk-Search/How-to-combine-chart-count-for-two-fields-in-one-search/m-p/426654#M122244 monipinni 2019-08-04T04:44:08Z Re: How to combine chart count for two fields in one search https://community.splunk.com/t5/Splunk-Search/How-to-combine-chart-count-for-two-fields-in-one-search/m-p/426655#M122245 <P>Does it work if you replace chart with this stats example?</P> <PRE><CODE> | stats count(field1) count(field2) </CODE></PRE> Sun, 04 Aug 2019 12:58:17 GMT https://community.splunk.com/t5/Splunk-Search/How-to-combine-chart-count-for-two-fields-in-one-search/m-p/426655#M122245 jkat54 2019-08-04T12:58:17Z Re: How to combine chart count for two fields in one search https://community.splunk.com/t5/Splunk-Search/How-to-combine-chart-count-for-two-fields-in-one-search/m-p/426656#M122246 <P>Try this,</P> <P><CODE><BR /> Basic Search AND body.response.failedUpcName=* OR body.failedUpcName=* <BR /> | rename body.response.failedUpcName as response_failedUpcName, body.failedUpcName as failedUpcName <BR /> | chart count by response_failedUpcName , failedUpcName<BR /> </CODE><BR /> Not sure on the exact reason for this, however reporting commands don't seem to be able to handle nested fields very well.</P> <P>If your goal is to get the fields separately</P> <P><CODE><BR /> Basic Search AND body.response.failedUpcName=* OR body.failedUpcName=* <BR /> | rename body.response.failedUpcName as response_failedUpcName, body.failedUpcName as failedUpcName <BR /> |fields response_failedUpcName, failedUpcName <BR /> | chart count(*) as *<BR /> </CODE></P> <P>If your goal is to get count based on one or the other based on what is available<BR /> <CODE><BR /> Basic Search AND body.response.failedUpcName=* OR body.failedUpcName=* <BR /> | rename body.response.failedUpcName as response_failedUpcName, body.failedUpcName as failedUpcName <BR /> | eval failedUpcName = coalesce(response_failedUpcName, failedUpcName) <BR /> | chart count by failedUpcName <BR /> </CODE></P> Sun, 04 Aug 2019 14:39:13 GMT https://community.splunk.com/t5/Splunk-Search/How-to-combine-chart-count-for-two-fields-in-one-search/m-p/426656#M122246 arjunpkishore5 2019-08-04T14:39:13Z