How can I have a Search return multiple Stats and a Total?

[TDeFrank]

I have an issue which seems to be simple but after 2 days I'm still struggling.  I am attempting to have one search return the number of Logins for a large set of Hosts for both Windows and Linux.  I have successfully figured out each Search which will give me the numbers I want, however it only ever returns 1 Stat row.  I want to be able to show both numbers plus a total.  Here is my search altered slightly for security...

index=windows [ inputlookup hosts.csv |  fields host] EventCode = 4627
|  stats count as winlogins
| appendcols
    [search index=linux [ inputlookup hosts.csv |  fields host]  type=login
|  stats count as linuxlogins]
| addtotals

What I get is each value and a Total but it only has 1 Statistics row so I am unsure how to create a useful Visualization(Report) which will ultimately be placed on a Dashboard.  How can I get 1 search to return all 3 values as seperate Statistics so I can post a Report on a Dashboard?

[ITWhisperer]

Have you tried something like

( index=windows EventCode = 4627 ) OR ( index=linux type=login ) [ inputlookup hosts.csv |  fields host]
| stats count by index
| addtotals

[TDeFrank]

Yes I've tried using or before with no success, your query below returns 0 Events so that will not work either.

[ITWhisperer]

Sorry I missed a pipe

( index=windows EventCode = 4627 ) OR ( index=linux type=login ) [ | inputlookup hosts.csv |  fields host]
| stats count by index
| addtotals

[TDeFrank]

I tried it with the additional pipe - still 0 events are returned.  I've been testing today and It seems that Splunk has an issue with OR if you are using a Lookup - no matter the syntax.  I even tried this way and it still returns 0 events...

(index=windows [ inputlookup hosts.csv |  fields host] EventCode = 4627) or (index=linux [ inputlookup hosts.csv |  fields host]  type=login)

Running each inside the ( ) individually works just fine, but using OR returns 0 events.

[ITWhisperer]

So, do you get the counts you need without the inputlookup?

[TDeFrank]

Holy Smokes - so the issue with the OR was I did not have it all caps - I thought an OR was an or but not here - cryptic...

[ITWhisperer]

Same goes for AND by the way - easy one to miss - been there, done that!