How to sum of two result of appending subsearch in Total

[Manasi25]

Hi,

I have two OUTPUT as " IA" and "IB" in one chart by appending sub search.

I want addcoltotals of sum of "IA" and "IB"

My input -

source type = router  routingKey=routingA OR routingKey=routingB

| stats sum(count) as count, avg(percent) as percent

| eval routingKey = "IA"
| append [ search routingKey=routingAA OR routingBB

| stats sum(count) as count, avg(percent) as percent

|eval routingKey = "IB" ]

| addcoltotals labelfield= routingKey label= “Total”

| table routingKey, count, percent

Result should be - 

routingKey   count   percent

IA                        50           50%

IB                         50           50%

Total                    ?               ?

Also, when i m searching result, its saying parsing job while giving output.

Do append command parsing my output? Is there any other command i can use instead of append.

[Nisha18789]

Hi @Manasi25 , what is the issue you are facing, as your query seems alright? Are you getting different result than what is expected or not getting any results at all? Also, I believe count and percent are existing fields in your logs, is that so?

[Manasi25]

the query - | addcoltotals labelfield= routingKey label= “Total” not resulting Output as below--

Total ?   ?

Yes, count and percent are existing fields in my logs.

I need output in a table as below. Total of count and percentage of "IA" and "IB" in last row.

routingKey count percent

IA                  50            50%

IB                  50             50%

Total            ?                   ?

I m getting only this -

IA           50         50%

IB           50         50%

I have mentions field values as well.here is my query --

source type = router routingKey=routingA OR routingKey=routingB

| stats sum(count) as count, avg(percent) as percent | eval routingKey = "IA"

| append [ search routingKey=routingAA OR routingBB

| stats sum(count) as count, avg(percent) as percent |eval routingKey = "IB" ]

| addcoltotals labelfield= routingKey label= “Total”

| table routingKey, count, percent

[Nisha18789 · Accepted solution]

Hi @Manasi25 , please use

| stats sum(count) as count, avg(percent) as percent | eval routingKey = "IA"

| append [ search routingKey=routingAA OR routingBB

| stats sum(count) as count, avg(percent) as percent |eval routingKey = "IB" ]

| addcoltotals labelfield=routingKey label=Total

| table routingKey, count, percent

[Manasi25]

Thanks ! Its worked. 

I m using append query multiple times for different searches for same index.

Its parsing my job. Please advise solution.