multiple searches combine into one report

[ajromero]

I have 3 reports that I want to put into one report, here is my search

sourcetype=MSExchange:*:MessageTracking source_id=SMTP (event_id=RECEIVE) user_bunit=Energy recipient_domain="IID.com"
| stats count as RECEIVE by recipient
|append
[search sourcetype=MSExchange:*:MessageTracking source_id=SMTP (event_id=SEND) user_bunit=Energy recipient_domain="IID.com" | stats count as SEND by recipient]
|table recipient, SEND, RECEIVE

The data I get is only the recipient and RECEIVE data, it does not display the SEND information

what  I missing here

[richgalloway · Accepted solution]

It seems like the answer should be clear, but I'm drawing a blank ATM.  Try this variant, instead.  BTW, you said 3 searches, but the query only does 2.

sourcetype=MSExchange:*:MessageTracking source_id=SMTP (event_id=RECEIVE OR event_id=SEND) user_bunit=Energy recipient_domain="IID.com"
| stats sum(eval(event_id=RECEIVE)) as RECEIVE, sum(eval(event_id=SEND)) by recipient
|table recipient, SEND, RECEIVE

This should run faster since it only makes one pass through the index (which you should specify). 

[alonsocaio]

Hi,

Could you please provide a sample of your logs?

Based on the fields described in your search I created a sample file and could reach the results using the following query:

index=... source_id=SMTP (event_id=RECEIVE) user_bunit=Energy recipient_domain="IID.com" 
| stats count as RECEIVE by recipient 
| append
    [ search index=... source_id=SMTP (event_id=SEND) user_bunit=Energy recipient_domain="IID.com" 
    | stats count as SEND by recipient] 
| stats values(SEND) as SEND, values(RECEIVE) as RECEIVE by recipient

The was my output: