Splunk Search

How to edit my search to get the total count of two search queries?

shivendra_infy
Path Finder

I have the following query which gives me a Total count of 2 searches but after evaluating, I am not getting the Total count. Please suggest something. In the end I need the Total count: suppose TotalA =7 and TotalB=10, so I need to display 17 in my dashboard.

index=lts source="dbmon-tail://LTS_*" Track_Name = "*" |dedup  CreatedDateTime,Component_Id,Frequency_Mapping_Id|stats count(Track_Name) AS TotalA| append [ search index=lts source="dbmon-tail://  ||fillnull value=NULL Frequency_Mapping_Id  |dedup Component_Id,Frequency_Mapping_Id|stats count(Track_Name) AS TotalB]|eval Total= TotalA+TotalB |table Total
0 Karma

somesoni2
Revered Legend

The append adds results of two searches in row-by-row manner, hence when you'll get two rows (one from each search) with each row having only corresponding Total field available and other Total field will be null. (row1- TotalA has value, TotalB is null and so on). Thus when you calculate Total=TotalA+TotalB, it will be null as one operand is null. You should be using appendcols functions instead which adds search results column,

 index=lts source="dbmon-tail://LTS_*" Track_Name = "*" |dedup  CreatedDateTime,Component_Id,Frequency_Mapping_Id|stats count(Track_Name) AS TotalA| appendcols [ search index=lts source="dbmon-tail://  ||fillnull value=NULL Frequency_Mapping_Id  |dedup Component_Id,Frequency_Mapping_Id|stats count(Track_Name) AS TotalB]|eval Total= TotalA+TotalB |table Total
0 Karma
Get Updates on the Splunk Community!

Modern way of developing distributed application using OTel

Recently, I had the opportunity to work on a complex microservice using Spring boot and Quarkus to develop a ...

Enterprise Security Content Update (ESCU) | New Releases

Last month, the Splunk Threat Research Team had 3 releases of new security content via the Enterprise Security ...

Archived Metrics Now Available for APAC and EMEA realms

We’re excited to announce the launch of Archived Metrics in Splunk Infrastructure Monitoring for our customers ...