https://community.splunk.com/t5/Splunk-Search/append-search-to-different-sources/m-p/290723#M87858 <P>Hi,</P> <P>I want to combine to searches:</P> <P>index=bla | stats count(al_responsecode) as "Total per responseCode al" by al_responsecode | appendcols [ search index=blaat2 sourcetype=access_log | stats count(responseCode) as "Total per responseCode" by responseCode] | table al_responsecode responseCode "Total per responseCode al" "Total per responseCode"</P> <P>1e search:<BR /> response code; total <BR /> 200;122<BR /> 204;16<BR /> 302;13<BR /> 304;23<BR /> 401;19<BR /> 404;44<BR /> 505;1</P> <P>2e search:<BR /> 200;113<BR /> 204;9<BR /> 304;23<BR /> 401;19<BR /> 404;4</P> <P>outcome:<BR /> 200;122;113<BR /> 204;16;9<BR /> 302;13;23<BR /> 304;23;19<BR /> 401;19;4<BR /> 404;44<BR /><BR /> 505;1 </P> <P>But I want:<BR /> 200;122;113<BR /> 204;16;9<BR /> 302;13;0<BR /> 304;23;23<BR /> 401;19;19<BR /> 404;44;4<BR /> 505;1;0</P> Tue, 29 Sep 2020 12:48:19 GMT arjangoos 2020-09-29T12:48:19Z https://community.splunk.com/t5/Splunk-Search/append-search-to-different-sources/m-p/290723#M87858 <P>Hi,</P> <P>I want to combine to searches:</P> <P>index=bla | stats count(al_responsecode) as "Total per responseCode al" by al_responsecode | appendcols [ search index=blaat2 sourcetype=access_log | stats count(responseCode) as "Total per responseCode" by responseCode] | table al_responsecode responseCode "Total per responseCode al" "Total per responseCode"</P> <P>1e search:<BR /> response code; total <BR /> 200;122<BR /> 204;16<BR /> 302;13<BR /> 304;23<BR /> 401;19<BR /> 404;44<BR /> 505;1</P> <P>2e search:<BR /> 200;113<BR /> 204;9<BR /> 304;23<BR /> 401;19<BR /> 404;4</P> <P>outcome:<BR /> 200;122;113<BR /> 204;16;9<BR /> 302;13;23<BR /> 304;23;19<BR /> 401;19;4<BR /> 404;44<BR /><BR /> 505;1 </P> <P>But I want:<BR /> 200;122;113<BR /> 204;16;9<BR /> 302;13;0<BR /> 304;23;23<BR /> 401;19;19<BR /> 404;44;4<BR /> 505;1;0</P> Tue, 29 Sep 2020 12:48:19 GMT https://community.splunk.com/t5/Splunk-Search/append-search-to-different-sources/m-p/290723#M87858 arjangoos 2020-09-29T12:48:19Z https://community.splunk.com/t5/Splunk-Search/append-search-to-different-sources/m-p/290724#M87859 <P>Try like this (after chart, there will a column for each index. replace the correct index name in the rename command)</P> <PRE><CODE>index=blah OR (index=blah2 sourcetype=access_log) | eval ResponseCode=coalesce(al_responsecode,responseCode) | chart count over ResponseCode by index | rename "blah" as "Total per responseCode al" , "blah2" as "Total per responseCode" </CODE></PRE> Wed, 08 Feb 2017 16:23:32 GMT https://community.splunk.com/t5/Splunk-Search/append-search-to-different-sources/m-p/290724#M87859 somesoni2 2017-02-08T16:23:32Z