https://community.splunk.com/t5/Splunk-Search/Combining-and-summing-the-results-of-two-searches/m-p/164232#M46639 <P>Hi -</P> <P>I have two searches that have the same fields exactly but from different sources.</P> <P>I would like to join and sum the results and output</P> <P>The searches:<BR /> index="atti" sourcetype="strongmail" source="/data1/strongmail/log/strongmail-retryfailed.log" mailingclass="smtpvhost1.yp.com"|stats count as NumberFailed by MailingId,Bouncetype </P> <P>MailingId, Bouncetype, NumberFailed<BR /> 12121,2004,2<BR /> 12058,3004,4</P> <P>index="atti" sourcetype="strongmail" source="/data1/strongmail/log/strongmail-failed.log" mailingclass="smtpvhost1.yp.com" |stats count as NumberFailed by MailingId,Bouncetype </P> <P>MailingId, Bouncetype, NumberFailed<BR /> 12121,2004,4<BR /> 12058,3004,6</P> <P>They return exactly as you see the same columns, I want combine(Sum) the results and output:</P> <P>MailingId, Bouncetype, NumberFailed<BR /> 12121,2004,6<BR /> 12058,3004,10</P> <P>Thanks.</P> Tue, 16 Jun 2015 00:05:21 GMT rajadatta 2015-06-16T00:05:21Z https://community.splunk.com/t5/Splunk-Search/Combining-and-summing-the-results-of-two-searches/m-p/164232#M46639 <P>Hi -</P> <P>I have two searches that have the same fields exactly but from different sources.</P> <P>I would like to join and sum the results and output</P> <P>The searches:<BR /> index="atti" sourcetype="strongmail" source="/data1/strongmail/log/strongmail-retryfailed.log" mailingclass="smtpvhost1.yp.com"|stats count as NumberFailed by MailingId,Bouncetype </P> <P>MailingId, Bouncetype, NumberFailed<BR /> 12121,2004,2<BR /> 12058,3004,4</P> <P>index="atti" sourcetype="strongmail" source="/data1/strongmail/log/strongmail-failed.log" mailingclass="smtpvhost1.yp.com" |stats count as NumberFailed by MailingId,Bouncetype </P> <P>MailingId, Bouncetype, NumberFailed<BR /> 12121,2004,4<BR /> 12058,3004,6</P> <P>They return exactly as you see the same columns, I want combine(Sum) the results and output:</P> <P>MailingId, Bouncetype, NumberFailed<BR /> 12121,2004,6<BR /> 12058,3004,10</P> <P>Thanks.</P> Tue, 16 Jun 2015 00:05:21 GMT https://community.splunk.com/t5/Splunk-Search/Combining-and-summing-the-results-of-two-searches/m-p/164232#M46639 rajadatta 2015-06-16T00:05:21Z https://community.splunk.com/t5/Splunk-Search/Combining-and-summing-the-results-of-two-searches/m-p/164233#M46640 <P>Like this:</P> <PRE><CODE>index="atti" sourcetype="strongmail" mailingclass="smtpvhost1.yp.com" (source="/data1/strongmail/log/strongmail-retryfailed.log" OR source="/data1/strongmail/log/strongmail-failed.log") |stats count as NumberFailed by MailingId,Bouncetype </CODE></PRE> Tue, 16 Jun 2015 00:39:52 GMT https://community.splunk.com/t5/Splunk-Search/Combining-and-summing-the-results-of-two-searches/m-p/164233#M46640 woodcock 2015-06-16T00:39:52Z https://community.splunk.com/t5/Splunk-Search/Combining-and-summing-the-results-of-two-searches/m-p/164234#M46641 <P>Hi rajadatta <BR /> Try the following query :</P> <PRE><CODE> |set union [search index="atti" sourcetype="strongmail" source="/data1/strongmail/log/strongmail-retryfailed.log" mailingclass="smtpvhost1.yp.com"|stats count as NumberFailed by MailingId,Bouncetype ] [search index="atti" sourcetype="strongmail" source="/data1/strongmail/log/strongmail-failed.log" mailingclass="smtpvhost1.yp.com" |stats count as NumberFailed by MailingId,Bouncetype ]|stats sum(NumberFailed) as total_NumberFailed </CODE></PRE> Tue, 16 Jun 2015 09:28:38 GMT https://community.splunk.com/t5/Splunk-Search/Combining-and-summing-the-results-of-two-searches/m-p/164234#M46641 chimell 2015-06-16T09:28:38Z https://community.splunk.com/t5/Splunk-Search/Combining-and-summing-the-results-of-two-searches/m-p/164235#M46642 <P>Thanks this gives me the total failed as count. I can use this as well for another report.</P> Tue, 16 Jun 2015 17:44:39 GMT https://community.splunk.com/t5/Splunk-Search/Combining-and-summing-the-results-of-two-searches/m-p/164235#M46642 rajadatta 2015-06-16T17:44:39Z https://community.splunk.com/t5/Splunk-Search/Combining-and-summing-the-results-of-two-searches/m-p/164236#M46643 <P>Thanks this is what I needed.</P> Tue, 16 Jun 2015 17:44:50 GMT https://community.splunk.com/t5/Splunk-Search/Combining-and-summing-the-results-of-two-searches/m-p/164236#M46643 rajadatta 2015-06-16T17:44:50Z https://community.splunk.com/t5/Splunk-Search/Combining-and-summing-the-results-of-two-searches/m-p/164237#M46644 <P>Thanks for the help. I went with the first answer as it was what I was looking for.</P> Tue, 16 Jun 2015 17:44:53 GMT https://community.splunk.com/t5/Splunk-Search/Combining-and-summing-the-results-of-two-searches/m-p/164237#M46644 rajadatta 2015-06-16T17:44:53Z