Splunk Enterprise

Can I combine 2 queries?

Ash1
Communicator

Below is my query1:

index=adc  source=abc  "FilesTrasfered DO980"  |timechart span=1d count  |stats count as D0980 Files



query2:

index=adc  source=abc  "FilesTrasfered DO981"  |timechart span=1d count  |stats count as D0981Files



i tried to combine 2 queries and get the result in table format, so i used append command, but i am getting result  in 2 different rows.

DO980 Files DO981 Files
500  
  230


But i want to get the results in the same row like shown in below format:

DO980 Files DO981 Files
500 230
Labels (1)
0 Karma

bowesmana
SplunkTrust
SplunkTrust

These queries seem a little odd

 

index=adc  source=abc  "FilesTrasfered DO980"
|timechart span=1d count
|stats count as D0980 Files

 

this search for example is counting the events per day with that matching string and then you are counting the number of days, it's not actually counting the number of events - is that what you want?

As to combining the searches - this is the basic combination

index=adc  source=abc  ("FilesTrasfered DO980" OR "FilesTrasfered DO981")
| eval type=if(match(_raw, "D0980"), "D0980", "D0981")
| timechart span=1d count by type
| stats count(*) as *

 however, if you are looking to count the number of events then 

index=adc  source=abc  ("FilesTrasfered DO980" OR "FilesTrasfered DO981")
| eval type=if(match(_raw, "D0980"), "D0980", "D0981")
| stats count by type
| transpose 0 header_field=type
Get Updates on the Splunk Community!

Splunk Observability for AI

Don’t miss out on an exciting Tech Talk on Splunk Observability for AI! Discover how Splunk’s agentic AI ...

[Puzzles] Solve, Learn, Repeat: Dereferencing XML to Fixed-length events

This challenge was first posted on Slack #puzzles channelFor a previous puzzle, I needed a set of fixed-length ...

Stay Connected: Your Guide to December Tech Talks, Office Hours, and Webinars!

What are Community Office Hours? Community Office Hours is an interactive 60-minute Zoom series where ...