Compare the result of two searches

[StianDanielsen]

I am trying to compare users logged in by device vs users logged in via html site.

For device, the query is something like:
index="prodenv" host="Somehost" Mobile.aspx s_port="443" cs_username!="-" | stats count

For html, the query is something like:
index="prodenv" cs_method="POST" cs_uri_stem="/data/commands.svc/login" sc_status="200" | stats count

I tried to combine these two with something like the following:
index="prodenv" host="Somehost" | eval mobile=Mobile.aspx s_port="443" cs_username!="-" | eval html=cs_method="POST" cs_uri_stem="/data/commands.svc/login" sc_status="200" | stats (make a pie showing mobile vs html)

...which of course didn't work.

How can I combine these two in order to achieve my desired result?

[Damien_Dallimor]

You could create an event type for each type of logon (device_logon & web_server_logon) , and then simply perform a search such as :

index=prodenv | stats count by eventtype

Your 2 event type searches would be :

device_logon event type

host="Somehost" Mobile.aspx s_port="443" cs_username!="-"

web_server_logon event type

cs_method="POST" cs_uri_stem="/data/commands.svc/login" sc_status="200"

[Damien_Dallimor]

1) if you are using Splunk 5.0, you can try Search accleration
2) you could use a saved scheduled search it, and then when the dashboard loads, it will load the results from the last time the search executed
3) you could use summary indexing

[StianDanielsen]

Thank you, Damien.

I tried it out, but it was running very slow. The search is for all of yesterday and the first part (index=prodenv) has a lot of data to go through.

Any other suggestions?