https://community.splunk.com/t5/Splunk-Search/How-to-combine-two-different-search-results-in-a-single/m-p/116993#M31140 <P>Found a simple solution: </P> <PRE><CODE>index=* sourcetype=type1 OR sourcetype=otherTypeB | timechart count(eval(sourcetype=="type1")) , count(eval(sourcetype=="otherTypeB")) </CODE></PRE> Mon, 02 Feb 2015 09:27:36 GMT kenvanderheyden 2015-02-02T09:27:36Z https://community.splunk.com/t5/Splunk-Search/How-to-combine-two-different-search-results-in-a-single/m-p/116992#M31139 <P>Hello, </P> <P>I'm having trouble combining two different search results, from different source type into one visualization. </P> <P>These are the two search strings: </P> <PRE><CODE>index=* sourcetype=typeA| stats count by date_year | eventstats avg(count) | rename count as "total", avg(count) as "global average" index=* sourcetype=otherTypeB| stats count by date_year | eventstats avg(count) | rename count as "total", avg(count) as "global average" </CODE></PRE> <P>Both searches result in a line. <BR /> I would like to see both in one visualization, so the correlation between the events if there is one, becomes visible. </P> <P>Tried using a join: </P> <PRE><CODE>index=* sourcetype=typeA| join date_year [search sourcetype=otherTypeB] | stats count by date_year | eventstats avg(count) </CODE></PRE> <P>But this results in having a single line. <BR /> Not sure how to proceed from here on. </P> <P>Regards, <BR /> Ken. </P> Mon, 02 Feb 2015 08:48:07 GMT https://community.splunk.com/t5/Splunk-Search/How-to-combine-two-different-search-results-in-a-single/m-p/116992#M31139 kenvanderheyden 2015-02-02T08:48:07Z https://community.splunk.com/t5/Splunk-Search/How-to-combine-two-different-search-results-in-a-single/m-p/116993#M31140 <P>Found a simple solution: </P> <PRE><CODE>index=* sourcetype=type1 OR sourcetype=otherTypeB | timechart count(eval(sourcetype=="type1")) , count(eval(sourcetype=="otherTypeB")) </CODE></PRE> Mon, 02 Feb 2015 09:27:36 GMT https://community.splunk.com/t5/Splunk-Search/How-to-combine-two-different-search-results-in-a-single/m-p/116993#M31140 kenvanderheyden 2015-02-02T09:27:36Z