I am writing a Splunk query where I need to send an alert if the count of both queries are not same. I am trying something like this - (index=staging AND "service-name" ) AND {"first" | stats count by data.message} as query1 AND {"second" | stats count by data.message} as query2 | eval compare=if(match(query1,query2),"True","False") This doesn't return anything. Can anyone point me in the right direction ? Query 1- index=staging "service-name" "First message" | timechart count by data.status Query 2- index=staging "service-name" "Second message" | timechart count by data.status In my code I am saving logs like ( "Second message length{length} date{date}) length is something that I am setting dynamically in my code. date will be today's date or any random date. So, basically I need to extract the value of length from Query 2 where date = "some random date" and then I will compare it with the count of Query 1 ... View more