Splunk Dev

how to combine 2 panel results and sum of that result will display in 3rd panel

dall
Path Finder

hi team 

Query 1(panel 1)

index=" " Message="*POWERING_ON*" host=" " | rex "(?<VMName>[^\/]+).vmx" | stats latest(host) as host, latest(_time) as time by VMName |eval time= strftime(time,"%d-%m-%Y %H:%M:%S")| stats count

 

query2(panel 2)

result=24

index="  " Message="*VM_STATE_POWERING_OFF*" host="  " | rex "(?<VMName>[^\/]+).vmx" | stats latest(host) as host, latest(_time) as time by VMName | eval time= strftime(time,"%d-%m-%Y %H:%M:%S") | append [| search index="  " "ha-datacenter is powered off" host="  " | rex "\s\:\s+(?P<VMName>.+)\son.\s" | stats latest(host) as host, latest(_time) as time by VMName] | eval time= strftime(time,"%d-%m-%Y %H:%M:%S") | dedup VMName | stats count

result=10

 

how i ll comine 2 query and get 1 panel with sum of  24+10=34

0 Karma

richgalloway
SplunkTrust
SplunkTrust

You accepted an answer to a similar question yesterday.  What's different here?

https://community.splunk.com/t5/Security-the-Enterprise/combine-2-query/m-p/521305#M36

---
If this reply helps you, Karma would be appreciated.
0 Karma

dall
Path Finder

here i want to add vm power on and off and i want to show total result

while adding only 2nd query result is showing

0 Karma
Get Updates on the Splunk Community!

Celebrating Fast Lane: 2025 Authorized Learning Partner of the Year

At .conf25, Splunk proudly recognized Fast Lane as the 2025 Authorized Learning Partner of the Year. This ...

Tech Talk Recap | Mastering Threat Hunting

Mastering Threat HuntingDive into the world of threat hunting, exploring the key differences between ...

Observability for AI Applications: Troubleshooting Latency

If you’re working with proprietary company data, you’re probably going to have a locally hosted LLM or many ...