Splunk Search

How to combine 2 stats count O/P to be displayed in one for use in Overlay Chart

promukh
Path Finder

search query 1 | stats count by source1.field1 | where blah ==blah | rename field1 as "Y-098"

Y-098 || Count
1.Instagram -- 56
2.twitter -- 78

search query 2 | stats count by source2.field2 | where blah ==blah | rename field2 as "Vr-234"

Vr-234 || Count
1.Instagram_active_user -- 34
2.twitter_active_user --21

How can i combine the above 2 searches to be displayed under one output as shown below to be used in Overlay Chart , also is there any way to rename the "Count" Field

Field-Name-1 | Count | Field-Name-2 | Count
Instagram | 56 | Instagram_active_user | 34
twitter | 78 | twitter_active_user | 21

0 Karma

woodcock
Esteemed Legend

Like this:

(search query 1) OR (search query 2)
| eval joiner=coalesce(source1.field1, source2.field2)
| stats count BY joiner
| eval {joiner} = count
| table joiner count *_active_user
| eventstats first(*_active_user) AS *_active_user
| foreach *_active_user [ eval active_user_count = if(joiner=="<<MATCHSTR>>", '<<FIELD>>', active_user_count) | fields - <<FIELD>> ]
| where isnotnull(active_user_count)

sumanssah
Communicator

Please try this

search query 1 | stats count by source1.field1 | where blah ==blah | rename field1 as "Y-098" 

| join 
    [| search query 2 | stats count by source2.field2 | where blah ==blah | rename field2 as "Vr-234" ]
0 Karma
Get Updates on the Splunk Community!

Introducing the 2024 SplunkTrust!

Hello, Splunk Community! We are beyond thrilled to announce our newest group of SplunkTrust members!  The ...

Introducing the 2024 Splunk MVPs!

We are excited to announce the 2024 cohort of the Splunk MVP program. Splunk MVPs are passionate members of ...

Splunk Custom Visualizations App End of Life

The Splunk Custom Visualizations apps End of Life for SimpleXML will reach end of support on Dec 21, 2024, ...