https://community.splunk.com/t5/Splunk-Search/How-to-edit-my-search-to-get-the-total-count-of-two-search/m-p/277158#M83584 <P>I have the following query which gives me a Total count of 2 searches but after evaluating, I am not getting the Total count. Please suggest something. In the end I need the Total count: suppose TotalA =7 and TotalB=10, so I need to display 17 in my dashboard.</P> <PRE><CODE>index=lts source="dbmon-tail://LTS_*" Track_Name = "*" |dedup CreatedDateTime,Component_Id,Frequency_Mapping_Id|stats count(Track_Name) AS TotalA| append [ search index=lts source="dbmon-tail:// ||fillnull value=NULL Frequency_Mapping_Id |dedup Component_Id,Frequency_Mapping_Id|stats count(Track_Name) AS TotalB]|eval Total= TotalA+TotalB |table Total </CODE></PRE> Mon, 12 Dec 2016 12:05:44 GMT shivendra_infy 2016-12-12T12:05:44Z https://community.splunk.com/t5/Splunk-Search/How-to-edit-my-search-to-get-the-total-count-of-two-search/m-p/277158#M83584 <P>I have the following query which gives me a Total count of 2 searches but after evaluating, I am not getting the Total count. Please suggest something. In the end I need the Total count: suppose TotalA =7 and TotalB=10, so I need to display 17 in my dashboard.</P> <PRE><CODE>index=lts source="dbmon-tail://LTS_*" Track_Name = "*" |dedup CreatedDateTime,Component_Id,Frequency_Mapping_Id|stats count(Track_Name) AS TotalA| append [ search index=lts source="dbmon-tail:// ||fillnull value=NULL Frequency_Mapping_Id |dedup Component_Id,Frequency_Mapping_Id|stats count(Track_Name) AS TotalB]|eval Total= TotalA+TotalB |table Total </CODE></PRE> Mon, 12 Dec 2016 12:05:44 GMT https://community.splunk.com/t5/Splunk-Search/How-to-edit-my-search-to-get-the-total-count-of-two-search/m-p/277158#M83584 shivendra_infy 2016-12-12T12:05:44Z https://community.splunk.com/t5/Splunk-Search/How-to-edit-my-search-to-get-the-total-count-of-two-search/m-p/277159#M83585 <P>The append adds results of two searches in row-by-row manner, hence when you'll get two rows (one from each search) with each row having only corresponding Total field available and other Total field will be null. (row1- TotalA has value, TotalB is null and so on). Thus when you calculate Total=TotalA+TotalB, it will be null as one operand is null. You should be using appendcols functions instead which adds search results column,</P> <PRE><CODE> index=lts source="dbmon-tail://LTS_*" Track_Name = "*" |dedup CreatedDateTime,Component_Id,Frequency_Mapping_Id|stats count(Track_Name) AS TotalA| appendcols [ search index=lts source="dbmon-tail:// ||fillnull value=NULL Frequency_Mapping_Id |dedup Component_Id,Frequency_Mapping_Id|stats count(Track_Name) AS TotalB]|eval Total= TotalA+TotalB |table Total </CODE></PRE> Mon, 12 Dec 2016 14:18:05 GMT https://community.splunk.com/t5/Splunk-Search/How-to-edit-my-search-to-get-the-total-count-of-two-search/m-p/277159#M83585 somesoni2 2016-12-12T14:18:05Z