How to Merge two query resultsets?

[runiyal]

I have two Searches and following are its result individually -

index="myindex" <my search 1> | table App Size Count

App  Size  Count
App1 5GB   100
App2 100GB 10000

index=myindex" <my search 2> | table App Size Count

App  Size Count
App3 15GB 1500

Now I want to run a report that shows result of all Apps (1 to 3) together. So, I used append.

index="myindex" <my search 1> | table App Size Count
| append
[search index=myindex" <my search 2> | table App Size Count]
| addcoltotals

But when I used it, I didn't get the complete result. "Size" column is showing different value. Something like this -

App  Size  Count
App1 5GB   100
App2 100GB 10000
App3 7GB   720

What should be used to get the complete resultset as we got for each search. Best way to merge two query resultsets.

Thanks!

[runiyal]

must be missing our something in the syntax but if I just use the OR between two searches like below I am getting Error in 'search' command: Unable to parse the search: unbalanced parentheses.

(<my search 1> OR <my search 2>)

 I have provided the complete search command above in reply to Renjith.

[renjith_nair]

You may try

index=myindex (search1 terms OR search2 terms) |table App,Size,Count|addcoltotals

[runiyal]

Here is the updated Query which actual use of REX/EVAL/CASE/STATS in it:

(index="myindex" "*upload succeeded" OR "*streaming succeeded" NOT "source"
| rex ".*SIZE=(?<sizeKB>\d+\.\d+)" | stats sum(eval(sizeKB/1024/1024)) AS Size count | eval App="Upload-Manual")
OR
(index="myindex" "*upload succeeded" OR "*streaming succeeded"
| rex "source=(?<App>[^,]+)."
| rex "system=(?<App>[^,]+)." | eval App = case(App="FB","App1",App="TWTR","App2",App="Salesforce","App3",App="SAP","App3",App="Oracle","App3")
| rex ".*SIZE=(?<sizeKB>\d+\.\d+)" | stats sum(eval(sizeKB/1024/1024)) AS Size Count by App)
| table App Size Count
| addcoltotals

I am getting following error - 

Error in 'search' command: Unable to parse the search: unbalanced parentheses.

Thanks!

[gcusello]

Hi @runiyal,

did you tried to put all the conditions in the main search?

something like this:

index="myindex" (<my search 1> OR <my search 2>)
| table App Size Count
| addcoltotals

Splunk isn't a DB!

Ciao.

Giuseppe