how to display the events for the Count

[mmengu416]

Hi All,

I am trying to display the events of the "count"(which is of multiple fields), how do I do that?
I am using the append/appendcol command to combine 2 queries and display its count. when I click the "count" it is taking me to the same query.

[mmengu416]

HI Anantha,
Thank you for the response,
yes, that is the query I am using. Assume I am using the query "Query1 | stats count as total1 | append[search Query2 | stats count as total2] | eval Total=total1+total2 | table Total" When I want to triage the "Total" events and click on the "Total" in Splunk, instead of displaying the events, it is taking me to the same query in another tab. the "Total" field does not provide the total events instead it is taking me to the same query "Query1 | stats count as total1 | append[search Query2 | stats count as total2] | eval Total=total1+total2 | table Total."

[Anantha123]

hi, Can you elaborate your question .
But for start if you want to count multiple fields then you can use like
|timechart count as Total, count(eval(status=success)) as Success, count(eval(field=A)) as FieldATotal .
You can also use stats instead of timechart .

If you want to count no of events from 2 different queries , then try
Query1 | stats count as total1 | append[search Query2 | stats count as total2] | eval Total=total1+total2 | table Total.

Let us know if you are looking something else here.
Thanks
Anantha.