How to combine the outputs of multiple searches into a single field ?

[Real_captain]

HI 

Can you please let me know how we can combine the outputs of multiple searches into a single field?? 

For example : 
We need a single output for the below 2 searches: 

Search1 : 

`macro_events_all_win_ops_esa` sourcetype=WinHostMon host=P9TWAEVV01STD (TERM(Esa_Invoice_Processor) OR TERM(Esa_Final_Demand_Processor) OR TERM(Esa_Initial_Listener_Service) OR TERM(Esa_MT535_Parser) OR TERM(Esa_MT540_Parser) OR TERM(Esa_MT542_Withdrawal_Request) OR TERM(Esa_MT544_Parser) OR TERM(Esa_MT546_Parser) OR TERM(Esa_MT548_Parser) OR TERM(Esa_SCM Batch_Execution) OR TERM(Euroclear_EVIS_Border_Internal) OR TERM(EVISExternalInterface))
| stats latest(State) as Current_Status by service
| where Current_Status != "Running"
| stats count as count_of_stopped_services
| eval status = if(count_of_stopped_services = 0 , "OK" , "NOK" )
| table status

Search2 : 

`macro_events_all_win_ops_esa` host="P9TWAEVV01STD" sourcetype=WinEventLog "Batch *Failed" System_Exception="*"
| stats count as count_of_failed_batches
| eval status = if(count_of_failed_batches = 0 , "OK" , "NOK" )
| table status

Output : 
If status for the search1 and status for the search2 is OK, then output should be OK. 

If status for the search1 or status for the search2 is NOK, then output should be NOK. 

[KendallW · Accepted solution]

Hi @Real_captain you can use append to combine the two searches, then get the status using eval if condition:

`macro_events_all_win_ops_esa` sourcetype=WinHostMon host=P9TWAEVV01STD (TERM(Esa_Invoice_Processor) OR TERM(Esa_Final_Demand_Processor) OR TERM(Esa_Initial_Listener_Service) OR TERM(Esa_MT535_Parser) OR TERM(Esa_MT540_Parser) OR TERM(Esa_MT542_Withdrawal_Request) OR TERM(Esa_MT544_Parser) OR TERM(Esa_MT546_Parser) OR TERM(Esa_MT548_Parser) OR TERM(Esa_SCM Batch_Execution) OR TERM(Euroclear_EVIS_Border_Internal) OR TERM(EVISExternalInterface)) 
| stats latest(State) as Current_Status by service 
| where Current_Status != "Running" 
| stats count as count_of_stopped_services 
| eval status = if(count_of_stopped_services = 0 , "OK" , "NOK" ) 
| fields status 

| append 
    [ search `macro_events_all_win_ops_esa` host="P9TWAEVV01STD" sourcetype=WinEventLog "Batch *Failed" System_Exception="*" 
    | stats count as count_of_failed_batches 
    | eval status = if(count_of_failed_batches = 0 , "OK" , "NOK" ) 
    | fields status
        ] 
        
| stats values(status) as status_list 
| eval final_status = if(mvcount(mvfilter(status_list=="NOK")) > 0, "NOK", "OK") 
| fields final_status