appendcols doesnot take any values from before searches . Appendcols queries as new query . Else can you try doing the calc the total and then use appendcols to extract accounts . (index=abc sourcetype=xyz event_type= "Only_Fail") | timechart count as Total | appendcols [ search (index=abc sourcetype=xyz event_type= "Only_Fail") OR ( index=def (TYPE1=10 OR TYPE2=20) ) | eval dex1 = if(index=="abc", 1, 0) | eval dex2 = if(index=="def", 1, 0) | eval myaccounts = coalesce(CUST_ID, account_number) | stats min(_time) as _time, sum(dex1) as dex1, sum(dex2) as dex2 by myaccounts | where dex2 = 0 and dex1 > 0 | timechart span=1h count(myaccounts) as total_accounts,sum(dex1) as all_fails ] ... View more

could you try? (index=abc sourcetype=xyz event_type= "FAIL") NOT [search index=def (ACTION=10 OR ACTION=20 OR ACTION=30)| dedup Emp_nummber | table Emp_nummber | rename Emp_nummber as account_number ] | stats count by account_number OR (index=abc sourcetype=xyz event_type= "FAIL") OR (index=def (ACTION=10 OR ACTION=20 OR ACTION=30)) | dedup Emp_nummber keepempty=true | dedup account_number keepempty=true | eval myNumber=coalesce(Emp_nummber,account_number) | eval from_index1=if(index="abc",1,null()) | stats dc(index) AS num_occurences sum(from_index1) AS from_index1 by myNumber | where num_occurences=1 AND from_index1=1 | table myNumber ... View more

Thanks for the added information. Multiple joins and unions can definitely slow a search. However, the sample query in your question does neither of those. Do you have answers for my questions? ... View more

It is not clear what you need but maybe this: index=america sourcetype=abc AND [ (index=america sourcetype=abc OR (index=russia actorClient=def) | multireport [search NOT [search index=russia actorClient=def flag_restricted=1 OR flag_peeked=1 | stats count by empNo | rename empNo as account_number | table account_number] |stats min(_time) as _time, sum(is_grace) as grace, ,sum(is_pass) as success, sum(is_fail) as fail by account_number, session_id | table account_number] [stats min(_time) as _time, sum(PTO) as PTO ,sum(peeked) as peeked by empNo | where PTO > 0 OR peeked > 0 | table empNo | rename empNo as account_number] [search NOT [search index=asia (TYPE=404 OR TYPE=505 OR TYPE=202 OR TYPE=303 OR TYPE=101) | stats count by employee_id |rename employee_id as account_number | table account_number | where account_number!=""] | stats min(_time) as _time, sum(is_grace) as grace, ,sum(is_pass) as success, sum(is_fail) as fail by account_number, session_id | where fail > 0 and success = 0 | table account_number] | stats count BY account_number | rename account_number AS empNo | table empNo ] | eval is_grace=if(event=="P_GRACE", 1, 0) | eval is_pass=if(event=="P_PASS", 1, 0) | eval is_fail=if(event=="P_FAIL", 1, 0) | stats min(_time) as _time, sum(is_grace) as grace, ,sum(is_pass) as success, sum(is_fail) as fail by account_number, session_id | eval all_fails = if(fail > 0 and success = 0, fail, 0) | timechart span=1h sum(all_fails) as FINAL_NUMBER ... View more

Thanks @gcusello .. This is working fine... ... View more

Hi @Vijeta even this query is working fine.. I think I got the mistake with my join. Thanks a lot. ... View more

Yeah.. I tried that one and it's working fine.. I'll use yours.. thanks ... View more

@rbechtold - Thanks a lot.. I think you are right, it's giving me correct answer. ... View more