Splunk Search

Table from two separate searches and sourcetypes

Brainstorms
Explorer

So, to preface this, I am very new to Splunk. 
The end game is to make a chart overlay, but that's not my main question here.

I have two searches with very similar information being returned. I need to make a table with information from both searches and I just can't seem to manage it. I have tried append, appendcols, multisearch, etc. The problem is that I cannot use OR for the sourcetype because the two sourcetypes have extremely similar information in them and the queries to pull from them are the exact same.
Example:

First:

index = indexa sourcetype = sourcetypeA 
| count X as "Result A"
| other logic etc
| table month_year "Result A"
 
Second:

index= indexa sourcetype = sourcetypeB
| count X as "Result B"
| other logic etc
| table month_year "Result B"

Ultimately I'd want the results to say:

month_YearResult BResult A
infoinfoinfo


Right now when I attempt to do anything, it just skips out on "Result B" entirely. I know there must be some simple way I'm just missing. If anyone could help me out I'd really appreciate it, this is driving me crazy.

Labels (2)
0 Karma
1 Solution

richgalloway
SplunkTrust
SplunkTrust

Perhaps this will help.

index = indexa (sourcetype = sourcetypeA  OR sourcetype = sourcetypeB)
| stats sum(eval(sourcetype=sourcetypA) as "Result A", sum(eval(sourcetype=sourcetypeB) as "Result B"
| other logic etc
| table month_year "Result A" "Result B"
---
If this reply helps you, Karma would be appreciated.

View solution in original post

richgalloway
SplunkTrust
SplunkTrust

Perhaps this will help.

index = indexa (sourcetype = sourcetypeA  OR sourcetype = sourcetypeB)
| stats sum(eval(sourcetype=sourcetypA) as "Result A", sum(eval(sourcetype=sourcetypeB) as "Result B"
| other logic etc
| table month_year "Result A" "Result B"
---
If this reply helps you, Karma would be appreciated.

Brainstorms
Explorer

THANK YOU. I knew I was close in some of my attempts but I just couldn't make the connection. This worked for me exactly as needed.

0 Karma
Get Updates on the Splunk Community!

Database Performance Sidebar Panel Now on APM Database Query Performance & Service ...

We’ve streamlined the troubleshooting experience for database-related service issues by adding a database ...

IM Landing Page Filter - Now Available

We’ve added the capability for you to filter across the summary details on the main Infrastructure Monitoring ...

Dynamic Links from Alerts to IM Navigators - New in Observability Cloud

Splunk continues to improve the troubleshooting experience in Observability Cloud with this latest enhancement ...