topic Re: How to join two searches for stats command in Splunk Search

How to join two searches for stats command

prakashbhanu407 — Tue, 22 Mar 2016 03:22:53 GMT

I have 2 queries and need to show the result of both in one table

index=someindex queryType="ts" filename=PNASC.HRBDT status=1 | dedup filename |rename filename as Daily| stats count(Daily)

index=someindex queryType="ts" filename=RECON status=1 | dedup filename |rename filename as Weekly | stats count(Weekly)

both the above queries work individually but when joined as below

gives incorrect output

Re: How to join two searches for stats command

sk314 — Tue, 22 Mar 2016 04:13:50 GMT

I am not sure why you are deduping. Assuming that's what you want...try this:

index=someindex queryType="ts" filename=RECON OR filename=PNASC.HRBDT status=1| dedup filename | stats count by  filename

Re: How to join two searches for stats command

fdi01 — Tue, 22 Mar 2016 09:21:40 GMT

try like

index=someindex queryType="ts" filename=PNASC.HRBDT status=1 | dedup filename |rename filename as Daily| stats count(Daily)|appendcols  [search index=someindex queryType="ts" filename=RECON status=1 | dedup filename |rename filename as Weekly | stats count(Weekly)]

Re: How to join two searches for stats command

prakashbhanu407 — Tue, 22 Mar 2016 12:02:13 GMT

The files have date timestamp extension and I need to show them bundled by the types...hence this will not work.

Re: How to join two searches for stats command

prakashbhanu407 — Tue, 22 Mar 2016 12:03:23 GMT

I was trying Joining the 2 searches but "appendcols" worked like a charm...thanks.

Re: How to join two searches for stats command

seeyonraj — Tue, 04 Aug 2020 06:11:57 GMT

Perfect!