Splunk Search

Combining and summing the results of two searches

rajadatta
New Member

Hi -

I have two searches that have the same fields exactly but from different sources.

I would like to join and sum the results and output

The searches:
index="atti" sourcetype="strongmail" source="/data1/strongmail/log/strongmail-retryfailed.log" mailingclass="smtpvhost1.yp.com"|stats count as NumberFailed by MailingId,Bouncetype

MailingId, Bouncetype, NumberFailed
12121,2004,2
12058,3004,4

index="atti" sourcetype="strongmail" source="/data1/strongmail/log/strongmail-failed.log" mailingclass="smtpvhost1.yp.com" |stats count as NumberFailed by MailingId,Bouncetype

MailingId, Bouncetype, NumberFailed
12121,2004,4
12058,3004,6

They return exactly as you see the same columns, I want combine(Sum) the results and output:

MailingId, Bouncetype, NumberFailed
12121,2004,6
12058,3004,10

Thanks.

Tags (2)
0 Karma
1 Solution

woodcock
Esteemed Legend

Like this:

index="atti" sourcetype="strongmail" mailingclass="smtpvhost1.yp.com" (source="/data1/strongmail/log/strongmail-retryfailed.log" OR source="/data1/strongmail/log/strongmail-failed.log") |stats count as NumberFailed by MailingId,Bouncetype

View solution in original post

0 Karma

chimell
Motivator

Hi rajadatta
Try the following query :

    |set union [search index="atti" sourcetype="strongmail" source="/data1/strongmail/log/strongmail-retryfailed.log" mailingclass="smtpvhost1.yp.com"|stats count as NumberFailed by MailingId,Bouncetype  ] [search index="atti" sourcetype="strongmail" source="/data1/strongmail/log/strongmail-failed.log" mailingclass="smtpvhost1.yp.com" |stats count as NumberFailed by MailingId,Bouncetype ]|stats sum(NumberFailed) as total_NumberFailed 
0 Karma

rajadatta
New Member

Thanks for the help. I went with the first answer as it was what I was looking for.

0 Karma

rajadatta
New Member

Thanks this gives me the total failed as count. I can use this as well for another report.

0 Karma

woodcock
Esteemed Legend

Like this:

index="atti" sourcetype="strongmail" mailingclass="smtpvhost1.yp.com" (source="/data1/strongmail/log/strongmail-retryfailed.log" OR source="/data1/strongmail/log/strongmail-failed.log") |stats count as NumberFailed by MailingId,Bouncetype
0 Karma

rajadatta
New Member

Thanks this is what I needed.

0 Karma
Get Updates on the Splunk Community!

See just what you’ve been missing | Observability tracks at Splunk University

Looking to sharpen your observability skills so you can better understand how to collect and analyze data from ...

Weezer at .conf25? Say it ain’t so!

Hello Splunkers, The countdown to .conf25 is on-and we've just turned up the volume! We're thrilled to ...

How SC4S Makes Suricata Logs Ingestion Simple

Network security monitoring has become increasingly critical for organizations of all sizes. Splunk has ...