How to combine two splunk searches based on a common field and display as single chart or table?

[vdalvi]

HI,

I have two searches per below

index=* host=* source=*
| eval TopicName=split(topicName,".")
| chart sum(size) as Todays_Count over TopicName | sort Todays_Count
| append
[
index=* host=* source=*
| stats count by propertiesTopicName, expectedCount | table propertiesTopicName expectedCount | sort expectedCount
]

Here I am using append which basically appends the result of 2nd search below the first search. I am looking to have it displayed besides one another based on the common field values of "TopicName" and "propertiesTopicName"

Basically end result I want is 3 columns being

propertiesTopicName | Todays_Count | expectedCount

How can I achieve this ? Please help 🙂

[bowesmana · Accepted solution]

It's unclear to me if propertiesTopicName and the multi valued split results from topicName are the same. If so, then why are you not using propertiesTopicName in the first search?

Anyway, the simple answer to what you look like you're trying to do is

index=* host=* source=*
| eval TopicName=split(topicName,".")
| chart sum(size) as Todays_Count over TopicName 
| rename TopicName as propertiesTopicName
| append
[
  index=* host=* source=*
  | stats count by propertiesTopicName, expectedCount 
  | table propertiesTopicName expectedCount 
]
| stats values(*) as * by propertiesTopicName
| sort Todays_Count expectedCount

You will need to resolve how you want the results to be sorted at the end.

But I suspect there is a simpler solution, but would need to understand what your data looks like.

[vdalvi]

Thank you! this is exactly what I was looking for 🙂