Hi Team, I'm new to Splunk and will need some help in getting this query total sum by timestamp as we are not explicitly timestamp from code. |mstats sum(_value) as total WHERE index='abc' | where total>0 ... View more

query 1 |mstats count(_value) as count1 WHERE metric_name="*metric1*" AND metric_type=c AND status="success" by metric_name,env,status| where count1>0 query 2 |mstats count(_value) as count2 WHERE metric_name="*metric2*" AND metric_type=c AND status="success" by metric_name,env,status| where count2=0 These queries are working fine individually I need combine show results only if  count1>0 and count2=0       ... View more