How to compare output of two splunk queries where nothing is common

[Emily12]

Hi Everyone

I have 2 queries 

1) mysearchquery | table xyz

2) mysearchquery| table abc

And these two queries does not have anything common

I need to compare xyz and abc in a single query 

How can I do that.

Thank you in advance 

[Emily12]

@ITWhisperer  basically I want to know how to join the search query result of 2 queries

[ITWhisperer]

mysearchquery | table xyz
| join type=left [ mysearchquery | table abc ]

Note that subsearches are limited by the number of events so if you can combine your two searches into one to do your calculations for xyz and abc it might be better

[Emily12]

Hi @ITWhisperer 

Xyz and abc will return some integer value to me so I will compare like if xyz=abc

[danspav]

If you are trying to add two numbers from two different searches it's highly likely you can do that in one search using stats.

Are you able to share more about each search?

Otherwise, you can do an append to combine the two outputs with something like:

| makeresults | eval abc=100 | table abc
| append [| makeresults |eval xyz=45 | table xyz]
| stats sum(abc) as abc, sum(xyz) as xyz
| eval total = abc + zyz

This search gets your first number, abc, then appends the second number, xyz.
Then we run stats to get them on one row, and finally do a simple eval for the total.

You could then use this result in a single value visualization on a dashboard.

But as I mentioned, you can probably get both totals using stats. See docs for more info.

[ITWhisperer]

Hi @Emily12 

If the two tables have nothing in common, what criteria are you going to use to compare them?