Splunk Search

Join two queries with different fields

JandrevdM
Path Finder

Hi All,

I have two queries which searches for users that use an app. The apps are not in the same fields which was why I had to split the queries. But now I want to join the queries to get the results

Query 1
index=db_it_network sourcetype=pan* url_domain="www.perplexity.ai"
| table user, url_domain, date_month
| stats count by user url_domain date_month 
| chart count by url_domain date_month 
| sort url_domain 0

Query 2
index=db_it_network sourcetype=pan*  app=claude-base OR app=google-gemini* OR app=openai* OR app=bing-ai-base
| table user, app, date_month
| stats count by user app date_month 
| chart count by app date_month 
| sort app 0

results example that I want

AppAugustJuly
claude-base123120
google-gemini12442
openai
153123
bing-ai-base212232
www.perplexity.com1412



Labels (1)
0 Karma
1 Solution

ITWhisperer
SplunkTrust
SplunkTrust

Try this

index=db_it_network sourcetype=pan* url_domain="www.perplexity.ai"
OR app=claude-base OR app=google-gemini* OR app=openai* OR app=bing-ai-base
| eval app=if(url_domain="www.perplexity.ai", url_domain, app)
| table user, app, date_month
| stats count by user app date_month 
| chart count by app date_month 
| sort app 0

View solution in original post

ITWhisperer
SplunkTrust
SplunkTrust

Try this

index=db_it_network sourcetype=pan* url_domain="www.perplexity.ai"
OR app=claude-base OR app=google-gemini* OR app=openai* OR app=bing-ai-base
| eval app=if(url_domain="www.perplexity.ai", url_domain, app)
| table user, app, date_month
| stats count by user app date_month 
| chart count by app date_month 
| sort app 0
Get Updates on the Splunk Community!

Brains, Bytes, and Boston: Learn from the Best at .conf25

When you think of Boston, you might picture colonial charm, world-class universities, or even the crack of a ...

Splunk AppDynamics Agents Webinar Series

Mark your calendars! On June 24th at 12PM PST, we’re going live with the second session of our Splunk ...

SplunkTrust Application Period is Officially OPEN!

It's that time, folks! The application/nomination period for the 2025 SplunkTrust is officially open! If you ...