hi team
Query 1(panel 1)
index=" " Message="*POWERING_ON*" host=" " | rex "(?<VMName>[^\/]+).vmx" | stats latest(host) as host, latest(_time) as time by VMName |eval time= strftime(time,"%d-%m-%Y %H:%M:%S")| stats count
query2(panel 2)
result=24
index=" " Message="*VM_STATE_POWERING_OFF*" host=" " | rex "(?<VMName>[^\/]+).vmx" | stats latest(host) as host, latest(_time) as time by VMName | eval time= strftime(time,"%d-%m-%Y %H:%M:%S") | append [| search index=" " "ha-datacenter is powered off" host=" " | rex "\s\:\s+(?P<VMName>.+)\son.\s" | stats latest(host) as host, latest(_time) as time by VMName] | eval time= strftime(time,"%d-%m-%Y %H:%M:%S") | dedup VMName | stats count
result=10
how i ll comine 2 query and get 1 panel with sum of 24+10=34
You accepted an answer to a similar question yesterday. What's different here?
https://community.splunk.com/t5/Security-the-Enterprise/combine-2-query/m-p/521305#M36
here i want to add vm power on and off and i want to show total result
while adding only 2nd query result is showing