Report from multiple indexes

[runiyal]

I need to create a report based on three different search criteria from three different sources. But since its a reconciliation report from three different systems, I need to make sure I present it in one report itself.

index=abc host="server-abc*" "upload succeeded" env=prd 

index=klm host="server-klm*" "index file" "*_prd.xml" 

index=xyz host="server-xyz*" "file uploaded" "Status code  : {}200"

The output/report I am trying to achieve is -

Index   Count
abc    100
klm       89
xyz     98

Will appreciate your ideas to achieve this.

[tiagofbmm]

Try this

( index=abc host="server-abc*" "upload succeeded" env=prd ) OR ( index=klm host="server-klm*" "index file" "*_prd.xml" ) OR ( 
 index=xyz host="server-xyz*" "file uploaded" "Status code  : {}200") | stats count by index

[runiyal]

Thank tiagofbmm and what if I need to give another name to each index. Like instead of "abc", if I want to show custom name like "Indexer1" and so on?