https://community.splunk.com/t5/Splunk-Search/how-to-append-query/m-p/449368#M127252 <P>Hi Guys <BR /> i have 3 queries </P> <P>query 1 : identity/phones/retrieve AND "[HTTP-STATUS-CODE]" | stats count as Total<BR /> query 2 : identity/phones/retrieve AND "[HTTP-STATUS-CODE]=200" | stats count as 200-Success<BR /> query 3 : identity/phones/retrieve AND "[HTTP-STATUS-CODE]=403" | stats count as 403-Forbidden</P> <P>how can i append this 3 queries and i want this to looks like a table with 3 columns<BR /> Total | 200-Success | 403-Forbidden</P> <P>please help on this .. Thanks in advance</P> Wed, 26 Jun 2019 09:59:23 GMT venkat0896 2019-06-26T09:59:23Z https://community.splunk.com/t5/Splunk-Search/how-to-append-query/m-p/449368#M127252 <P>Hi Guys <BR /> i have 3 queries </P> <P>query 1 : identity/phones/retrieve AND "[HTTP-STATUS-CODE]" | stats count as Total<BR /> query 2 : identity/phones/retrieve AND "[HTTP-STATUS-CODE]=200" | stats count as 200-Success<BR /> query 3 : identity/phones/retrieve AND "[HTTP-STATUS-CODE]=403" | stats count as 403-Forbidden</P> <P>how can i append this 3 queries and i want this to looks like a table with 3 columns<BR /> Total | 200-Success | 403-Forbidden</P> <P>please help on this .. Thanks in advance</P> Wed, 26 Jun 2019 09:59:23 GMT https://community.splunk.com/t5/Splunk-Search/how-to-append-query/m-p/449368#M127252 venkat0896 2019-06-26T09:59:23Z https://community.splunk.com/t5/Splunk-Search/how-to-append-query/m-p/449369#M127253 <P>@venkat0896 ,</P> <P>Try ,</P> <PRE><CODE>"your base search"|stats count as Total,count(eval(HTTP-STATUS-CODE==200)) as 200-Success,count(eval(HTTP-STATUS-CODE=="403")) as 403-Forbidden </CODE></PRE> Wed, 26 Jun 2019 11:45:35 GMT https://community.splunk.com/t5/Splunk-Search/how-to-append-query/m-p/449369#M127253 renjith_nair 2019-06-26T11:45:35Z https://community.splunk.com/t5/Splunk-Search/how-to-append-query/m-p/449370#M127254 <P>hi @renjith.nair i tried it <BR /> getting this error </P> <P>Error in 'stats' command: The eval expression for dynamic field 'eval(HTTP-STATUS-CODE=="403")' is invalid. Error='Typechecking failed. The '==' operator received different types.'</P> Wed, 26 Jun 2019 12:24:00 GMT https://community.splunk.com/t5/Splunk-Search/how-to-append-query/m-p/449370#M127254 venkat0896 2019-06-26T12:24:00Z https://community.splunk.com/t5/Splunk-Search/how-to-append-query/m-p/449371#M127255 <P>@venkat0896 , is it possible to share the stats part of your search? Please check if you have used the status codes as string (with ") and numeric (without ") in two places and if yes, change it to single format</P> Wed, 26 Jun 2019 12:28:38 GMT https://community.splunk.com/t5/Splunk-Search/how-to-append-query/m-p/449371#M127255 renjith_nair 2019-06-26T12:28:38Z