https://community.splunk.com/t5/Splunk-Search/How-to-combine-searches-to-generate-stats-of-domains-with-quot/m-p/240515#M71500 <P>I am attempting to combine two searches against a custom app within custom props.conf but am going in circles. Both searches are the same, with the exception of: Search1 is reporting on a "yes" or success statement, Search2 is reporting on a "no" or failed statement. I am trying to generate stats of domains with a success column and a failure column. Is there a better way?</P> <P>Search 1</P> <PRE><CODE>eventtype=some_events APP1 | search (*) (*) NOT ("filter expression") | search "APP1 Version:" OR "MODULE: Report MESSAGE: Results:" OR "Response" system=* | transaction system maxspan=24h | eval completed=if(searchmatch("Results:"),"yes","no") | search completed=yes | rex field=system "[^.]*.(?.*)" | stats count by FQDN | sort -count | rename count AS success | dedup FQDN </CODE></PRE> <P>Search 2</P> <PRE><CODE>eventtype=some_events APP1 | search (*) (*) NOT ("filter expression") | search "APP1 Version:" OR "MODULE: Report MESSAGE: Results:" OR "Response" system=* | transaction system maxspan=24h | eval completed=if(searchmatch("Results:"),"yes","no") | search completed!=yes | rex field=system "[^.]*.(?.*)" | stats count by FQDN | sort -count | rename count AS failed | dedup FQDN </CODE></PRE> <P>Desired output:</P> <PRE><CODE>FQDN Success Failed domain1.com ## ## domain2.com ## ## </CODE></PRE> Tue, 17 Jan 2017 18:37:57 GMT tlmayes 2017-01-17T18:37:57Z https://community.splunk.com/t5/Splunk-Search/How-to-combine-searches-to-generate-stats-of-domains-with-quot/m-p/240515#M71500 <P>I am attempting to combine two searches against a custom app within custom props.conf but am going in circles. Both searches are the same, with the exception of: Search1 is reporting on a "yes" or success statement, Search2 is reporting on a "no" or failed statement. I am trying to generate stats of domains with a success column and a failure column. Is there a better way?</P> <P>Search 1</P> <PRE><CODE>eventtype=some_events APP1 | search (*) (*) NOT ("filter expression") | search "APP1 Version:" OR "MODULE: Report MESSAGE: Results:" OR "Response" system=* | transaction system maxspan=24h | eval completed=if(searchmatch("Results:"),"yes","no") | search completed=yes | rex field=system "[^.]*.(?.*)" | stats count by FQDN | sort -count | rename count AS success | dedup FQDN </CODE></PRE> <P>Search 2</P> <PRE><CODE>eventtype=some_events APP1 | search (*) (*) NOT ("filter expression") | search "APP1 Version:" OR "MODULE: Report MESSAGE: Results:" OR "Response" system=* | transaction system maxspan=24h | eval completed=if(searchmatch("Results:"),"yes","no") | search completed!=yes | rex field=system "[^.]*.(?.*)" | stats count by FQDN | sort -count | rename count AS failed | dedup FQDN </CODE></PRE> <P>Desired output:</P> <PRE><CODE>FQDN Success Failed domain1.com ## ## domain2.com ## ## </CODE></PRE> Tue, 17 Jan 2017 18:37:57 GMT https://community.splunk.com/t5/Splunk-Search/How-to-combine-searches-to-generate-stats-of-domains-with-quot/m-p/240515#M71500 tlmayes 2017-01-17T18:37:57Z https://community.splunk.com/t5/Splunk-Search/How-to-combine-searches-to-generate-stats-of-domains-with-quot/m-p/240516#M71501 <P>try something like this</P> <PRE><CODE>eventtype=some_events APP1 | search () () NOT ("filter expression") | search "APP1 Version:" OR "MODULE: Report MESSAGE: Results:" OR "Response" system= | transaction system maxspan=24h | eval completed=if(searchmatch("Results:"),"yes","no") | rex field=system "[^.].(?.*)" | stats count(eval(match(completed,"yes"))) as success count(eval(match(completed,"no"))) as failed by FQDN </CODE></PRE> Tue, 17 Jan 2017 18:41:50 GMT https://community.splunk.com/t5/Splunk-Search/How-to-combine-searches-to-generate-stats-of-domains-with-quot/m-p/240516#M71501 cmerriman 2017-01-17T18:41:50Z https://community.splunk.com/t5/Splunk-Search/How-to-combine-searches-to-generate-stats-of-domains-with-quot/m-p/240517#M71502 <P>Worked perfect. Greatly appreciated</P> Tue, 17 Jan 2017 18:46:49 GMT https://community.splunk.com/t5/Splunk-Search/How-to-combine-searches-to-generate-stats-of-domains-with-quot/m-p/240517#M71502 tlmayes 2017-01-17T18:46:49Z