https://community.splunk.com/t5/Splunk-Search/how-to-join-2-different-searches-in-a-single-index-with/m-p/81372#M20614 <P>I have a new problem now when i try to filter the search with a fieldname value and both the search has different name.</P> <P>Query-1 has the field name as "SessionType" and Query-2 has the field name as "Product" and i am trying to filter the search by having Product="meeting" and i am not getting the complete result set.</P> <OL> <LI>When i try and query as given below, i see the expected result :</LI> </OL> <P>sourcetype="broker" host="g2m*" (createUpdateAttendeeResource OR Participant_System_Information) | rename OSType as OS | eval OS = if(OS=="" or isnull(OS),ClientName,OS) | rename Product as Producttype | eval ProductType = if(ProductType=="" or isnull(ProductType),Sessiontype,ProductType) | top limit=4 OS</P> <PRE><CODE>OS count percent Windows 16530 86.580767 MacOSX 2250 11.785041 iOS 234 1.225644 android 78 0.408548 </CODE></PRE> <P>But when i use the filter - "SessionType="meeting" i just get only one result set :</P> <P>sourcetype="broker" host="g2m*" (createUpdateAttendeeResource OR Participant_System_Information) | rename OSType as OS | eval OS = if(OS=="" or isnull(OS),ClientName,OS) | rename Product as Producttype | eval ProductType = if(ProductType=="" or isnull(ProductType),Sessiontype,ProductType) | search SessionType="meeting" | top limit=4 OS</P> <P>OS count percent<BR /> Windows 11677 86.656772<BR /> 2MacOSX 1615 11.985158<BR /> iOS 183 1.358071</P> <P>I am not sure why the second query result set is not give - where i need the count for "android" as i got from the step-1. </P> <P>Please help.</P> Mon, 28 Sep 2020 11:58:30 GMT balavenkatachal 2020-09-28T11:58:30Z https://community.splunk.com/t5/Splunk-Search/how-to-join-2-different-searches-in-a-single-index-with/m-p/81372#M20614 <P>I have a new problem now when i try to filter the search with a fieldname value and both the search has different name.</P> <P>Query-1 has the field name as "SessionType" and Query-2 has the field name as "Product" and i am trying to filter the search by having Product="meeting" and i am not getting the complete result set.</P> <OL> <LI>When i try and query as given below, i see the expected result :</LI> </OL> <P>sourcetype="broker" host="g2m*" (createUpdateAttendeeResource OR Participant_System_Information) | rename OSType as OS | eval OS = if(OS=="" or isnull(OS),ClientName,OS) | rename Product as Producttype | eval ProductType = if(ProductType=="" or isnull(ProductType),Sessiontype,ProductType) | top limit=4 OS</P> <PRE><CODE>OS count percent Windows 16530 86.580767 MacOSX 2250 11.785041 iOS 234 1.225644 android 78 0.408548 </CODE></PRE> <P>But when i use the filter - "SessionType="meeting" i just get only one result set :</P> <P>sourcetype="broker" host="g2m*" (createUpdateAttendeeResource OR Participant_System_Information) | rename OSType as OS | eval OS = if(OS=="" or isnull(OS),ClientName,OS) | rename Product as Producttype | eval ProductType = if(ProductType=="" or isnull(ProductType),Sessiontype,ProductType) | search SessionType="meeting" | top limit=4 OS</P> <P>OS count percent<BR /> Windows 11677 86.656772<BR /> 2MacOSX 1615 11.985158<BR /> iOS 183 1.358071</P> <P>I am not sure why the second query result set is not give - where i need the count for "android" as i got from the step-1. </P> <P>Please help.</P> Mon, 28 Sep 2020 11:58:30 GMT https://community.splunk.com/t5/Splunk-Search/how-to-join-2-different-searches-in-a-single-index-with/m-p/81372#M20614 balavenkatachal 2020-09-28T11:58:30Z https://community.splunk.com/t5/Splunk-Search/how-to-join-2-different-searches-in-a-single-index-with/m-p/81373#M20615 <P>Opps ! typo on the query, <BR /> i got the answer for this as i misspelled the fieldname as "Producttype " instead of "ProductType" ( 'T' in uppercase) and i could see the result now :</P> <P>sourcetype="broker" host="g2m*" (createUpdateAttendeeResource OR Participant_System_Information) | rename OSType as OS | eval OS = if(OS=="" or isnull(OS),ClientName,OS) | rename Product as ProductType | eval ProductType = if(ProductType="" or isnull(ProductType),SessionType,ProductType) | search ProductType="meeting" | top OS</P> Mon, 28 Sep 2020 11:58:32 GMT https://community.splunk.com/t5/Splunk-Search/how-to-join-2-different-searches-in-a-single-index-with/m-p/81373#M20615 balavenkatachal 2020-09-28T11:58:32Z