can I aggregate two queries

[rakesh_498115]

I Have Two sourcetypes defined . i need to write a query integrating the two sourcetypes and should get a single result.

i.e for example
Sourcetype="X" | (some logic )|stats avg(duration) as Avgresponsetime1

Sourcetype="Y" | (some logic ) |stats avg(duration) as Avgresponsetime2

Now i need a single Query which gives me the ouput as avgresponsetime of the avg from the previous two reponsetimes..

i have tried like this..but didnt work..

(Sourcetype="X" | (some logic )|stats avg(duration) as Avgresponsetime1) OR ( Sourcetype="Y" | (some logic ) |stats avg(duration) as Avgresponsetime2 ) | eval responsetime=avgresponsetime1+avgresponsetime2 | table responsetime

Please help me on this asap..thanx

[Ayn · Accepted solution]

You can't put an OR between them because by the time you get to the OR you've already "left" the initial search command and piped it to a number of other commands.

You could use append for getting results from the two searches and then run stats on all results:

 Sourcetype="X" | (some logic )| append [search Sourcetype="Y" | (some logic )] | stats avg(duration) as responsetime