Splunk Enterprise

Can I combine 2 queries?

Ash1
Communicator

Below is my query1:

index=adc  source=abc  "FilesTrasfered DO980"  |timechart span=1d count  |stats count as D0980 Files



query2:

index=adc  source=abc  "FilesTrasfered DO981"  |timechart span=1d count  |stats count as D0981Files



i tried to combine 2 queries and get the result in table format, so i used append command, but i am getting result  in 2 different rows.

DO980 Files DO981 Files
500  
  230


But i want to get the results in the same row like shown in below format:

DO980 Files DO981 Files
500 230
Labels (1)
0 Karma

bowesmana
SplunkTrust
SplunkTrust

These queries seem a little odd

 

index=adc  source=abc  "FilesTrasfered DO980"
|timechart span=1d count
|stats count as D0980 Files

 

this search for example is counting the events per day with that matching string and then you are counting the number of days, it's not actually counting the number of events - is that what you want?

As to combining the searches - this is the basic combination

index=adc  source=abc  ("FilesTrasfered DO980" OR "FilesTrasfered DO981")
| eval type=if(match(_raw, "D0980"), "D0980", "D0981")
| timechart span=1d count by type
| stats count(*) as *

 however, if you are looking to count the number of events then 

index=adc  source=abc  ("FilesTrasfered DO980" OR "FilesTrasfered DO981")
| eval type=if(match(_raw, "D0980"), "D0980", "D0981")
| stats count by type
| transpose 0 header_field=type
Get Updates on the Splunk Community!

Index This | Why did the turkey cross the road?

November 2025 Edition  Hayyy Splunk Education Enthusiasts and the Eternally Curious!   We’re back with this ...

Enter the Agentic Era with Splunk AI Assistant for SPL 1.4

  🚀 Your data just got a serious AI upgrade — are you ready? Say hello to the Agentic Era with the ...

Feel the Splunk Love: Real Stories from Real Customers

Hello Splunk Community,    What’s the best part of hearing how our customers use Splunk? Easy: the positive ...