https://community.splunk.com/t5/Splunk-Search/Getting-2-aggregate-result-for-2-searches/m-p/166112#M47296 <P>Your sample search does not really make sense.</P> <PRE><CODE>host=ABC | append [search host=DEF] </CODE></PRE> <P>is the same as</P> <PRE><CODE>host=ABC or host=DEF </CODE></PRE> <P>Sample events and a sketch of the desired output would be better if you want more qualified help.</P> <P>/k</P> Wed, 26 Feb 2014 14:14:21 GMT kristian_kolb 2014-02-26T14:14:21Z https://community.splunk.com/t5/Splunk-Search/Getting-2-aggregate-result-for-2-searches/m-p/166111#M47295 <P>My search string is<BR /> host=ABC| append [search host=DEF]|stats sum(V) by "ER Code"<BR /> Can I have a count function also with search.Count should by calculated based on another field.</P> <P>Ex:host=ABC| append [search host=DEF]|stats sum(V) by "ER Code"|stats count(I) by "User"<BR /> Is it possible to achieve this result.</P> Wed, 26 Feb 2014 13:36:31 GMT https://community.splunk.com/t5/Splunk-Search/Getting-2-aggregate-result-for-2-searches/m-p/166111#M47295 jimjohn 2014-02-26T13:36:31Z https://community.splunk.com/t5/Splunk-Search/Getting-2-aggregate-result-for-2-searches/m-p/166112#M47296 <P>Your sample search does not really make sense.</P> <PRE><CODE>host=ABC | append [search host=DEF] </CODE></PRE> <P>is the same as</P> <PRE><CODE>host=ABC or host=DEF </CODE></PRE> <P>Sample events and a sketch of the desired output would be better if you want more qualified help.</P> <P>/k</P> Wed, 26 Feb 2014 14:14:21 GMT https://community.splunk.com/t5/Splunk-Search/Getting-2-aggregate-result-for-2-searches/m-p/166112#M47296 kristian_kolb 2014-02-26T14:14:21Z