Hi - I have two searches that have the same fields exactly but from different sources. I would like to join and sum the results and output The searches: index="atti" sourcetype="strongmail" source="/data1/strongmail/log/strongmail-retryfailed.log" mailingclass="smtpvhost1.yp.com"|stats count as NumberFailed by MailingId,Bouncetype MailingId, Bouncetype, NumberFailed 12121,2004,2 12058,3004,4 index="atti" sourcetype="strongmail" source="/data1/strongmail/log/strongmail-failed.log" mailingclass="smtpvhost1.yp.com" |stats count as NumberFailed by MailingId,Bouncetype MailingId, Bouncetype, NumberFailed 12121,2004,4 12058,3004,6 They return exactly as you see the same columns, I want combine(Sum) the results and output: MailingId, Bouncetype, NumberFailed 12121,2004,6 12058,3004,10 Thanks. ... View more

Hi - I would like to join two logs and get specific result as table. I want to join by two common fields. Been working on getting this all day and need help. so I have log 1 as below and want these values in a table index="atti" sourcetype="strongmail" source="/data1/strongmail/log/strongmail-device-category.log" | table DateStamp UserId mailingid ttype DeviceInfo I have log 2 index="atti" sourcetype="strongmail" source="/data1/strongmail/log/strongmail-success.log" The common fields I want to join by mailingid,UserId. In this second log, I want to only return the field EMAIL In the end I need including the first logs output and second logs output in a table So looking for this DateStamp UserId EMAIL mailingid ttype DeviceInfo Thanks for any help, if more info is needed, I will gladly input them in this forum ... View more

Hi - I have been trying to get this search below to result in separate rows depending on the values. I have the information below: My current search index="atti" sourcetype="strongmail" source="/data1/strongmail/log/strongmail-failed.log" | chart count(mailingclass) as NumberFailed by mailingclass which results in: mailingclass NumberFailed smtpvhost1.adsolutions.yp.com 136 smtpvhost1.yp.com 131 smtpvhost3.yp.com 124 smtpvhost2.adsolutions.yp.com 28 smtpvhost3.adsolutions.yp.com 8 smtpvhost2.yp.com 2 I want to get two rows: first row "Consumer" where mailingclass="smtpvhost1.yp.com" OR mailingclass="smtpvhost2.yp.com" OR mailingclass="smtpvhost3.yp.com" second row "Advertiser" where mailingclass="smtpvhost1.adsolutions.yp.com" OR mailingclass="smtpvhost2.adsolutions.yp.com" OR mailingclass="smtpvhost3.adsolutions.yp.com" Now I want to only have two total rows. an example would be something like this: ORGANIZATION Failed Consumer 172 Advertiser 257 Any help would be great, this is so much easier in SQL, I am having issues all day in SPLUNK. Thanks. ... View more