Splunk Search

Join two queries with different fields

JandrevdM
Path Finder

Hi All,

I have two queries which searches for users that use an app. The apps are not in the same fields which was why I had to split the queries. But now I want to join the queries to get the results

Query 1
index=db_it_network sourcetype=pan* url_domain="www.perplexity.ai"
| table user, url_domain, date_month
| stats count by user url_domain date_month 
| chart count by url_domain date_month 
| sort url_domain 0

Query 2
index=db_it_network sourcetype=pan*  app=claude-base OR app=google-gemini* OR app=openai* OR app=bing-ai-base
| table user, app, date_month
| stats count by user app date_month 
| chart count by app date_month 
| sort app 0

results example that I want

AppAugustJuly
claude-base123120
google-gemini12442
openai
153123
bing-ai-base212232
www.perplexity.com1412



Labels (1)
0 Karma
1 Solution

ITWhisperer
SplunkTrust
SplunkTrust

Try this

index=db_it_network sourcetype=pan* url_domain="www.perplexity.ai"
OR app=claude-base OR app=google-gemini* OR app=openai* OR app=bing-ai-base
| eval app=if(url_domain="www.perplexity.ai", url_domain, app)
| table user, app, date_month
| stats count by user app date_month 
| chart count by app date_month 
| sort app 0

View solution in original post

ITWhisperer
SplunkTrust
SplunkTrust

Try this

index=db_it_network sourcetype=pan* url_domain="www.perplexity.ai"
OR app=claude-base OR app=google-gemini* OR app=openai* OR app=bing-ai-base
| eval app=if(url_domain="www.perplexity.ai", url_domain, app)
| table user, app, date_month
| stats count by user app date_month 
| chart count by app date_month 
| sort app 0
Get Updates on the Splunk Community!

Splunk Observability Cloud’s AI Assistant in Action Series: Analyzing and ...

This is the second post in our Splunk Observability Cloud’s AI Assistant in Action series, in which we look at ...

Elevate Your Organization with Splunk’s Next Platform Evolution

 Thursday, July 10, 2025  |  11AM PDT / 2PM EDT Whether you're managing complex deployments or looking to ...

Splunk Answers Content Calendar, June Edition

Get ready for this week’s post dedicated to Splunk Dashboards! We're celebrating the power of community by ...