Splunk Search

How to combine 2 stats count O/P to be displayed in one for use in Overlay Chart

promukh
Path Finder

search query 1 | stats count by source1.field1 | where blah ==blah | rename field1 as "Y-098"

Y-098 || Count
1.Instagram -- 56
2.twitter -- 78

search query 2 | stats count by source2.field2 | where blah ==blah | rename field2 as "Vr-234"

Vr-234 || Count
1.Instagram_active_user -- 34
2.twitter_active_user --21

How can i combine the above 2 searches to be displayed under one output as shown below to be used in Overlay Chart , also is there any way to rename the "Count" Field

Field-Name-1 | Count | Field-Name-2 | Count
Instagram | 56 | Instagram_active_user | 34
twitter | 78 | twitter_active_user | 21

0 Karma

woodcock
Esteemed Legend

Like this:

(search query 1) OR (search query 2)
| eval joiner=coalesce(source1.field1, source2.field2)
| stats count BY joiner
| eval {joiner} = count
| table joiner count *_active_user
| eventstats first(*_active_user) AS *_active_user
| foreach *_active_user [ eval active_user_count = if(joiner=="<<MATCHSTR>>", '<<FIELD>>', active_user_count) | fields - <<FIELD>> ]
| where isnotnull(active_user_count)

sumanssah
Communicator

Please try this

search query 1 | stats count by source1.field1 | where blah ==blah | rename field1 as "Y-098" 

| join 
    [| search query 2 | stats count by source2.field2 | where blah ==blah | rename field2 as "Vr-234" ]
0 Karma
Get Updates on the Splunk Community!

September Community Champions: A Shoutout to Our Contributors!

As we close the books on another fantastic month, we want to take a moment to celebrate the people who are the ...

Splunk Decoded: Service Maps vs Service Analyzer Tree View vs Flow Maps

It’s Monday morning, and your phone is buzzing with alert escalations – your customer-facing portal is running ...

What’s New in Splunk Observability – September 2025

What's NewWe are excited to announce the latest enhancements to Splunk Observability, designed to help ITOps ...