Splunk Search

Getting 2 aggregate result for 2 searches

Path Finder

My search string is
host=ABC| append [search host=DEF]|stats sum(V) by "ER Code"
Can I have a count function also with search.Count should by calculated based on another field.

Ex:host=ABC| append [search host=DEF]|stats sum(V) by "ER Code"|stats count(I) by "User"
Is it possible to achieve this result.

0 Karma

Ultra Champion

Your sample search does not really make sense.

host=ABC | append [search host=DEF]

is the same as

host=ABC or host=DEF

Sample events and a sketch of the desired output would be better if you want more qualified help.

/k