Need to print 2 counts with different time intervals

[bapun18]

Hi Team,
I need to use print two values from an index with different earliest values. please find the below example.

index=abcd cust_name="*" earliest=-30d@d
| fields cust_name,origUserid,destUserid,finalCalledPartyUnicodeLoginUserID,callingPartyUnicodeLoginUserID
| eval id =coalesce(origUserid,destUserid,finalCalledPartyUnicodeLoginUserID,callingPartyUnicodeLoginUserID)
| rename cust_name as Customer
| dedup id
| stats count(id) as MAU by Customer
| appendcols
[ search index=abcd cust_name="*" earliest=-14d
| fields cust_name,origUserid,destUserid,finalCalledPartyUnicodeLoginUserID,callingPartyUnicodeLoginUserID
| eval id =coalesce(origUserid,destUserid,finalCalledPartyUnicodeLoginUserID,callingPartyUnicodeLoginUserID)
| rename cust_name as Customer
| dedup id
| stats count(id) as DAU by Customer
| eval DAU=round(DAU/14,2)
]


My problem is I am using two earliest values so in my first earliest value I have a customer count of 57 and on the second earliest value customer count is 43, so while printing both the values it's printing the wrong value in one column.

[ITWhisperer]

Appendcols puts the results in order without correlating with the common column

To check this, you could alter your search like this

index=abcd cust_name="*" earliest=-30d@d
| fields cust_name,origUserid,destUserid,finalCalledPartyUnicodeLoginUserID,callingPartyUnicodeLoginUserID
| eval id =coalesce(origUserid,destUserid,finalCalledPartyUnicodeLoginUserID,callingPartyUnicodeLoginUserID)
| rename cust_name as Customer
| dedup id
| stats count(id) as MAU by Customer
| eval MAU=Customer.":".MAU
| appendcols
[ search index=abcd cust_name="*" earliest=-14d
| fields cust_name,origUserid,destUserid,finalCalledPartyUnicodeLoginUserID,callingPartyUnicodeLoginUserID
| eval id =coalesce(origUserid,destUserid,finalCalledPartyUnicodeLoginUserID,callingPartyUnicodeLoginUserID)
| rename cust_name as Customer
| dedup id
| stats count(id) as DAU by Customer
| eval DAU=round(DAU/14,2)
| eval DAU=Customer.":".DAU
]

[bapun18]

Yeah but this can be a way but, client isn't happy with it they need data like customer in one column and rest values each per column.

[ITWhisperer]

Can you give an example/mock up of what your customer would like it to look like?