how get a single output from 2 different "stats count"

[antoniofacchi]

Good morning,

with the following search:
index="app_dynatrace" sourcetype="pa" application="Saipemcom Prod" "dimensions.Apdex performance zone for User Actions" !=unknown
| append [search index="app_dynatrace" sourcetype="visit" application="Saipemcom Prod"
| spath "dimensions.Visits - Geo Information" output=Country_visit]| spath "dimensions.Apdex performance zone for User Actions" output=Apdex_val|spath "dimensions.Country of Visits" output=Country1 | rex field=Country1 "(?\S+(\s\w))(\s+-)?"
|eval Country_useraction=trim(CountryS)|fields Country_useraction, Country_visit

I'd like a single output like:

Country Visit Useraction
Italy 800 1000
USA 100 123
.... .... .........

Many thanks for the support.
Regards
Antonio

[gcusello · Accepted solution]

Hi antoniofacchi,
I cannot replicate your search, but if you have the same output of both your searches, you can merge them, see this example:

index=index1
| stats count AS Total1 BY host
| append [ search index=index2 | stats count AS Total2 BY host ]
| stats values(Total1) AS Total1 values(Total2) AS Total2 BY host

It's important to have in both main and sub searches the same BY field and assign a name to each output (or outputs) of the stats command.
In this way you have on the same row values of Total1 and Total2 for each host.

Bye.
Giuseppe

[antoniofacchi]

Hi Giuseppe,

thank you for the suggestion,it works very well.

regards
Antonio

[gcusello]

Hi Antonio,
if you're satisfied by this answer accept or upvote it.
Ciao.
Giuseppe

[anjambha]

Hi antoniofacchi,

You can use join command to get the same output .. refer below link

http://docs.splunk.com/Documentation/Splunk/7.0.0/SearchReference/Join

[antoniofacchi]

HI anjambha,

thank you for the suggetion,it works very well.

regards
Antonio