How to append search as new row?

[jaj]

Given the following query, how can I append the second query so that the results show up as two rows so I can graph the results (in a pie chart).

// This query appends a new search as an additional col but what I really want i a new row.
source=*/blah/the.log "labelData= " | stats count as NOMATCHES
| appendcols [search source=*/blah/the.log labelData!="" | stats count as MATCHES ]


[yannK · Accepted solution]

try the append instead of appendcols

[jaj]

single query is exactly what I was looking for...I just what i was looking for...the labelData= was messing my query up as I couldn't query it by null or by labelData="". This worked awesome! Thanks!

[yannK]

but you could also do all in a single search with an eval or a case and define your own field.

example

source=*/blah/the.log "labelData= " OR labelData!=""
| eval label=if(isnull(labelData),"nomatch","match")
| stats count by label

[somesoni2]

just use "append" instead of "appendcols"