topic Can I add two table values in a single table in Splunk Search

Can I add two table values in a single table

rkishoreqa — Thu, 10 Sep 2020 17:20:17 GMT

Hi team,

How can I add the below two queries into one single query and present in a single table.

query 1 : index="dev_envi" | chart count(ApplicationName) over ApplicationName by Status |addtotals
Result : app1 5
app2 8

query 2 : index="dev_envi" | chart count(event.ApplicationName) over event.ApplicationName by event.Status |addtotals
Result : app1 3
app2 6

Now I need a single query to add above both values and display in Dashboard like below (adding above both table data):
app1 8
app2 14

Re: Can I add two table values in a single table

richgalloway — Thu, 10 Sep 2020 17:48:10 GMT

See if this helps.

index="dev_envi" | eval ApplicationName = coalesce(event.ApplicationName, ApplicationName), Status = coalesce(event.Status, Status) | chart count(ApplicationName) as count over ApplicationName by Status | addtotals

Re: Can I add two table values in a single table

rkishoreqa — Thu, 10 Sep 2020 18:35:59 GMT

Hi rich,

Thanks for the quick response

For this single query I am getting results as same as below query results.
- index="dev_envi" | chart count(ApplicationName) over ApplicationName by Status |addtotals

and missing the results of the query - index="dev_envi" | chart count(event.ApplicationName) over event.ApplicationName by event.Status |addtotals

Re: Can I add two table values in a single table

richgalloway — Thu, 10 Sep 2020 19:27:50 GMT

Can you share some sample events of both types. please?