Splunk Search

Table from two separate searches and sourcetypes

Brainstorms
Explorer

So, to preface this, I am very new to Splunk. 
The end game is to make a chart overlay, but that's not my main question here.

I have two searches with very similar information being returned. I need to make a table with information from both searches and I just can't seem to manage it. I have tried append, appendcols, multisearch, etc. The problem is that I cannot use OR for the sourcetype because the two sourcetypes have extremely similar information in them and the queries to pull from them are the exact same.
Example:

First:

index = indexa sourcetype = sourcetypeA 
| count X as "Result A"
| other logic etc
| table month_year "Result A"
 
Second:

index= indexa sourcetype = sourcetypeB
| count X as "Result B"
| other logic etc
| table month_year "Result B"

Ultimately I'd want the results to say:

month_YearResult BResult A
infoinfoinfo


Right now when I attempt to do anything, it just skips out on "Result B" entirely. I know there must be some simple way I'm just missing. If anyone could help me out I'd really appreciate it, this is driving me crazy.

Labels (2)
0 Karma
1 Solution

richgalloway
SplunkTrust
SplunkTrust

Perhaps this will help.

index = indexa (sourcetype = sourcetypeA  OR sourcetype = sourcetypeB)
| stats sum(eval(sourcetype=sourcetypA) as "Result A", sum(eval(sourcetype=sourcetypeB) as "Result B"
| other logic etc
| table month_year "Result A" "Result B"
---
If this reply helps you, Karma would be appreciated.

View solution in original post

richgalloway
SplunkTrust
SplunkTrust

Perhaps this will help.

index = indexa (sourcetype = sourcetypeA  OR sourcetype = sourcetypeB)
| stats sum(eval(sourcetype=sourcetypA) as "Result A", sum(eval(sourcetype=sourcetypeB) as "Result B"
| other logic etc
| table month_year "Result A" "Result B"
---
If this reply helps you, Karma would be appreciated.

Brainstorms
Explorer

THANK YOU. I knew I was close in some of my attempts but I just couldn't make the connection. This worked for me exactly as needed.

0 Karma
Get Updates on the Splunk Community!

🌟 From Audit Chaos to Clarity: Welcoming Audit Trail v2

🗣 You Spoke, We Listened  Audit Trail v2 wasn’t written in isolation—it was shaped by your voices.  In ...

Splunk New Course Releases for a Changing World

Every day, the world feels like it’s moving faster with new technological breakthroughs, AI innovation, and ...

Insights from .conf 2025, Smart Edge Processor Scaling, and a New Splunk Lantern ...

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...