Splunk Search

How to edit my search to get the total count of two search queries?

shivendra_infy
Path Finder

I have the following query which gives me a Total count of 2 searches but after evaluating, I am not getting the Total count. Please suggest something. In the end I need the Total count: suppose TotalA =7 and TotalB=10, so I need to display 17 in my dashboard.

index=lts source="dbmon-tail://LTS_*" Track_Name = "*" |dedup  CreatedDateTime,Component_Id,Frequency_Mapping_Id|stats count(Track_Name) AS TotalA| append [ search index=lts source="dbmon-tail://  ||fillnull value=NULL Frequency_Mapping_Id  |dedup Component_Id,Frequency_Mapping_Id|stats count(Track_Name) AS TotalB]|eval Total= TotalA+TotalB |table Total
0 Karma

somesoni2
Revered Legend

The append adds results of two searches in row-by-row manner, hence when you'll get two rows (one from each search) with each row having only corresponding Total field available and other Total field will be null. (row1- TotalA has value, TotalB is null and so on). Thus when you calculate Total=TotalA+TotalB, it will be null as one operand is null. You should be using appendcols functions instead which adds search results column,

 index=lts source="dbmon-tail://LTS_*" Track_Name = "*" |dedup  CreatedDateTime,Component_Id,Frequency_Mapping_Id|stats count(Track_Name) AS TotalA| appendcols [ search index=lts source="dbmon-tail://  ||fillnull value=NULL Frequency_Mapping_Id  |dedup Component_Id,Frequency_Mapping_Id|stats count(Track_Name) AS TotalB]|eval Total= TotalA+TotalB |table Total
0 Karma
Get Updates on the Splunk Community!

Technical Workshop Series: Splunk Data Management and SPL2 | Register here!

Hey, Splunk Community! Ready to take your data management skills to the next level? Join us for a 3-part ...

Spotting Financial Fraud in the Haystack: A Guide to Behavioral Analytics with Splunk

In today's digital financial ecosystem, security teams face an unprecedented challenge. The sheer volume of ...

Solve Problems Faster with New, Smarter AI and Integrations in Splunk Observability

Solve Problems Faster with New, Smarter AI and Integrations in Splunk Observability As businesses scale ...