search query 1 | stats count by source1.field1 | where blah ==blah | rename field1 as "Y-098"
Y-098 || Count
1.Instagram -- 56
2.twitter -- 78
search query 2 | stats count by source2.field2 | where blah ==blah | rename field2 as "Vr-234"
Vr-234 || Count
1.Instagram_active_user -- 34
2.twitter_active_user --21
How can i combine the above 2 searches to be displayed under one output as shown below to be used in Overlay Chart , also is there any way to rename the "Count" Field
Field-Name-1 | Count | Field-Name-2 | Count
Instagram | 56 | Instagram_active_user | 34
twitter | 78 | twitter_active_user | 21
Like this:
(search query 1) OR (search query 2)
| eval joiner=coalesce(source1.field1, source2.field2)
| stats count BY joiner
| eval {joiner} = count
| table joiner count *_active_user
| eventstats first(*_active_user) AS *_active_user
| foreach *_active_user [ eval active_user_count = if(joiner=="<<MATCHSTR>>", '<<FIELD>>', active_user_count) | fields - <<FIELD>> ]
| where isnotnull(active_user_count)
Please try this
search query 1 | stats count by source1.field1 | where blah ==blah | rename field1 as "Y-098"
| join
[| search query 2 | stats count by source2.field2 | where blah ==blah | rename field2 as "Vr-234" ]