I am new to Splunk and facing an issue in separating out the two columns of the query. I tried with the below query and found the results as shown below in table1
...| append [search index="pd" "successful" "notif/output/" | stats count by _raw |fields count | rename _raw as Dtransfer] | append [search index="pd" "SBID=nr" "DM" "PAM=sende" "notif/archive/" | stats count by _raw |fields count | rename _raw as DMCopy]
How do I achieve the expected result shown in Table 2? I need to display two separate columns DtransferCount and DMCopyCount
Specify the name of the count field in the stats commands.
...|
append [search index="pd" "successful" "notif/output/" | stats count as DtransferCount by _raw |fields DtransferCount | rename _raw as Dtransfer] |
append [search index="pd" "SBID=nr" "DM" "PAM=sende" "notif/archive/" | stats count as DDMCopyCount by _raw |fields DDMCopyCount | rename _raw as DMCopy]