Combining two searches

[Deepz2612]

Hi,
I have 2 searches and the results are as below
1st search result:
xyz 200 400 500 600 502
Add 0 1 0 0 0
Delete 0 2 1 3 4

2nd search result:
wer 200 400 500 600 502
Add_call 0 1 0 0 0
Now_call 0 2 1 3 4

Kindly help!!

[renjith_nair · Accepted solution]

@Deepz2612 ,

OK based on the comments try ,

"your base search to get API and Service events"
|eval _tmp=Service."#".api|chart count over _tmp by response_code
|rex field=_tmp "(?<Service>.+)#(?<api>.+)"|fields Service,api,*

[renjith_nair]

@Deepz2612 ,
so did you check why this is not working? It works for a test data, so we should look into your events. Do you see some data for
your base search Service=* api=* |head 10 |table Service api response_code|eval tmp=Service."#".api

[Deepz2612]

This worked!

[jvishwak]

Can you try combing API and Service values together (with some delimiter) and then run chart command: like:
eval X = Api . "/ ". Service | Chart values(total) over X by response_code
After this you can split the combined value in separate fields.

[Deepz2612]

Nope this is not working..
The concatenation and chart over concatenated field is fetching no results..
So both the above suggestions are not working..

[renjith_nair]

@Deepz2612,

• Are these (api,service) part of the same event or different events?
• Are the count going to be same always for both API/SERVICE? If count over API is different from SERVICE, how do you want to represent the count in the final result?
• How do you relate API to service ? i.e. Add to add_call , delete to delete_call etc?