Greetings. Is it possible merge 2 search? If there is any common value than connect it. If there is no match keep the events with null()'s I have tired with join function, but the join function are drop those events where there is no match. ... View more

Hello! I would like to count from a field based on another field. I have a events with following  2 fields (Doors_Order & RQM_Order). I would like to count based on Doors_Order field from entire RQM_Order fields. In excel this look like this: =COUNTIF(E:E;C9)   I have tried with this: | basesearch | eventstats count(eval(RQMOrder_NotValidated=RQMOrder)) as ReqGap2 But this will count only if the 2 field is same in 1 event, not in entire events lists. I have tired lots of another things, but non of them worked. In excel this looks easy. Is there any solution in splunk?     ... View more