I want to merge my data into single row, also I want to add the trendchart based on the date/time, please check below the more details.

[krsuraj11]

index="indexsplunk" host=host* tag="Failure" "Transaction" | stats count as Total
|append [search index="indexsplunk" host=host* tag="Failure" "EFGH" | stats count as Total]

Right now, output is displaying in 2 rows, since I append so one more row added for 2nd search. Please help me getting the data populated in one field and also suggest how to add the date while searching.

[adonio]

try this:

(index="indexsplunk" host=host* tag="Failure" "Transaction" ) OR (index="indexsplunk" host=host* tag="ABCD" "EFGH") 
| stats count(eval(tag=="Failure")) as fail_count count(eval(tag=="ABCD")) as adcd_count

[krsuraj11]

Hi, it gives me the 0 result, actually tag is common for both, can you please check again.

[adonio]

try and use this formula, here i use wild cards in eval %Fail% you might not need.

| makeresults count=1000
| eval random_for_text = random()%2
| eval text_to_search = if(random_for_text=="0","Failure","EFGH")
| stats count(eval(like(text_to_search,"%Fail%"))) as fail_count count(eval(like(text_to_search, "%EF%"))) as efgh_count

in your case itll be maybe something like this:
index="indexsplunk" host=host* tag="Failure" "Transaction" ("Failure" OR "EFGH")
| stats count(eval(like(_raw,"Failure"))) as fail_count count(eval(like(_raw, "EFGH"))) as efgh_count
hope it helps

[grittonc]

Do the two rows have anything in common?

[krsuraj11]

Yes, Index, Host and Tag are common, please help