Merge results of multiple queries

[twh1]

I have used the multiple queries and merged them in single output. When I using timechart, getting the expected result but when using bar chart we are not getting first query result as bar. Instead of bar it's showing the x-axis value.

Below is sample type of my query.

index=index1 | stats count as Field1 | appendcols [ search index=index2 | stats count as Field2] | appendcols [ search index=index3 | stats count as Field3] | appendcols [ search index=index4 | stats count as Field4] | appendcols [ search index=index5 | stats count as Field5]

We are getting write value in statistics tab, but in visualization tab after selecting bar chart, I am not getting field1.

[niketn · Accepted solution]

@ twh1.... Pipe transpose and see if it helps (your five queries clubbed together does not have row names for Index and Count.

| transpose column_name=count

Check out following Splunk documentation example to tackle the scenario you are facing.
https://docs.splunk.com/Documentation/Splunk/latest/SearchReference/Transpose#3._Transpose_a_set_of_...

However, if you are just counting total events in your indexes you should use dbinspect, tstats, metadata or eventcount command which have been specifically designed for this task (following command using eventcount will give you all eventcount for all indexes including Splunk's internal index, you can mention your index1 thru index5 using OR in the example below or with a wildcard pattern if possible):

| eventcount summarize=false index=* OR index=_*
| table index count