I need to combine a normal search for 24 hr period with all events and a subsearch on threshold based event where it should query for a certain type of event exceeding a count of 3 in a hour for a host
i ran the below command provided by martin-mueller in earlier thread
https://answers.splunk.com/answers/176574/combining-a-stats-search-and-normal-search.html
index=server earliest=-24h | append [search index=server event-type=high mem-ultilzation | stats count by hostname | where NOT event-type="high mem-utilization" OR count > 3
It does provide the host which exceeded the threshold, but the count provided for the event with the threshold value is incorrect.
It gives the value as 1 with a flat sparkline, when there were 5 actually occurrences in an hour
I need the count to be displayed as 5 and not as 1
Can someone please help in martin's absence
