Splunk Search
Highlighted

append search to different sources

Path Finder

Hi,

I want to combine to searches:

index=bla | stats count(alresponsecode) as "Total per responseCode al" by alresponsecode | appendcols [ search index=blaat2 sourcetype=accesslog | stats count(responseCode) as "Total per responseCode" by responseCode] | table alresponsecode responseCode "Total per responseCode al" "Total per responseCode"

1e search:
response code; total
200;122
204;16
302;13
304;23
401;19
404;44
505;1

2e search:
200;113
204;9
304;23
401;19
404;4

outcome:
200;122;113
204;16;9
302;13;23
304;23;19
401;19;4
404;44

505;1

But I want:
200;122;113
204;16;9
302;13;0
304;23;23
401;19;19
404;44;4
505;1;0

0 Karma
Highlighted

Re: append search to different sources

SplunkTrust
SplunkTrust

Try like this (after chart, there will a column for each index. replace the correct index name in the rename command)

index=blah OR (index=blah2 sourcetype=access_log)  | eval ResponseCode=coalesce(al_responsecode,responseCode) 
| chart  count over ResponseCode by index | rename "blah" as "Total per responseCode al" , "blah2" as  "Total per responseCode" 
0 Karma
Speak Up for Splunk Careers!

We want to better understand the impact Splunk experience and expertise has has on individuals' careers, and help highlight the growing demand for Splunk skills.