Combining and summing the results of two searches

[rajadatta]

Hi -

I have two searches that have the same fields exactly but from different sources.

I would like to join and sum the results and output

The searches:
index="atti" sourcetype="strongmail" source="/data1/strongmail/log/strongmail-retryfailed.log" mailingclass="smtpvhost1.yp.com"|stats count as NumberFailed by MailingId,Bouncetype

MailingId, Bouncetype, NumberFailed
12121,2004,2
12058,3004,4

index="atti" sourcetype="strongmail" source="/data1/strongmail/log/strongmail-failed.log" mailingclass="smtpvhost1.yp.com" |stats count as NumberFailed by MailingId,Bouncetype

MailingId, Bouncetype, NumberFailed
12121,2004,4
12058,3004,6

They return exactly as you see the same columns, I want combine(Sum) the results and output:

MailingId, Bouncetype, NumberFailed
12121,2004,6
12058,3004,10

Thanks.

[chimell]

Hi rajadatta
Try the following query :

    |set union [search index="atti" sourcetype="strongmail" source="/data1/strongmail/log/strongmail-retryfailed.log" mailingclass="smtpvhost1.yp.com"|stats count as NumberFailed by MailingId,Bouncetype  ] [search index="atti" sourcetype="strongmail" source="/data1/strongmail/log/strongmail-failed.log" mailingclass="smtpvhost1.yp.com" |stats count as NumberFailed by MailingId,Bouncetype ]|stats sum(NumberFailed) as total_NumberFailed 

[rajadatta]

Thanks for the help. I went with the first answer as it was what I was looking for.

[rajadatta]

Thanks this gives me the total failed as count. I can use this as well for another report.

[woodcock · Accepted solution]

Like this:

index="atti" sourcetype="strongmail" mailingclass="smtpvhost1.yp.com" (source="/data1/strongmail/log/strongmail-retryfailed.log" OR source="/data1/strongmail/log/strongmail-failed.log") |stats count as NumberFailed by MailingId,Bouncetype

[rajadatta]

Thanks this is what I needed.