How to edit my search to combine 4 columns into one total column?

[JoshuaJohn]

Hi

I'm new to the community and to Splunk. I am trying to combine the 4 columns my search creates into one total column or one column that is separated by the 4 search terms (it's one column with different colors for the different search terms) . This is my search term below: (This creates 4 columns: CREATED, LINKED, Session_Cancelled, and Session_Failed)

index=company_myapp REQUEST_URL:*payment/myapp* AND (REQUEST_METHOD:PUT OR REQUEST_METHOD:POST) AND (CURRENT_STATUS:CREATED OR CURRENT_STATUS:LINKED OR CURRENT_STATUS:SESSION_*)  | rex "CURRENT_STATUS:(?.*)" |stats count by status_name

I tried this, but Splunk said index is not a search term.

index=company_myapp REQUEST_URL:*payment/myapp* AND (REQUEST_METHOD:PUT OR REQUEST_METHOD:POST) AND (CURRENT_STATUS:CREATED OR CURRENT_STATUS:LINKED OR CURRENT_STATUS:SESSION_*)  | rex "CURRENT_STATUS:(?.*)" |stats count by status_name | append [index=company_myapp REQUEST_URL:*payment/myapp* | stats count by URL]

Any suggestions, ideas?

[sundareshr]

See if this gives you what you are looking for

index=company_myapp REQUEST_URL:*payment/myapp* AND (REQUEST_METHOD:PUT OR REQUEST_METHOD:POST) AND (CURRENT_STATUS:CREATED OR CURRENT_STATUS:LINKED OR CURRENT_STATUS:SESSION_*)  | rex "CURRENT_STATUS:(?.*)" | stats latest(status_name) as status by url

[JoshuaJohn]

This returned "no data"

[sundareshr]

Does your data have status_name and url fields extracted? If no, those need to be extracted using rex or some other method.

[Raschko]

Subsearches have to start with the command search. So this should work:

     index=company_myapp REQUEST_URL:*payment/myapp* AND 
(REQUEST_METHOD:PUT OR REQUEST_METHOD:POST) AND 
(CURRENT_STATUS:CREATED OR CURRENT_STATUS:LINKED OR CURRENT_STATUS:SESSION_*)  
    | rex "CURRENT_STATUS:(?<status_name>.*)" 
    | stats count by status_name 
    | append [search index=company_myapp REQUEST_URL:*payment/myapp* | stats count by URL]

Edit:
Your rex command is wrong in this. Sorry no testing ground at the moment.
Not sure about the field name status_name.

If all fails, do you have some example events (sanitized) to show?

[JoshuaJohn]

This returned the original graph to me