Splunk Search

Getting 2 aggregate result for 2 searches

jimjohn
Path Finder

My search string is
host=ABC| append [search host=DEF]|stats sum(V) by "ER Code"
Can I have a count function also with search.Count should by calculated based on another field.

Ex:host=ABC| append [search host=DEF]|stats sum(V) by "ER Code"|stats count(I) by "User"
Is it possible to achieve this result.

0 Karma

kristian_kolb
Ultra Champion

Your sample search does not really make sense.

host=ABC | append [search host=DEF]

is the same as

host=ABC or host=DEF

Sample events and a sketch of the desired output would be better if you want more qualified help.

/k

Get Updates on the Splunk Community!

Introducing the 2024 SplunkTrust!

Hello, Splunk Community! We are beyond thrilled to announce our newest group of SplunkTrust members!  The ...

Introducing the 2024 Splunk MVPs!

We are excited to announce the 2024 cohort of the Splunk MVP program. Splunk MVPs are passionate members of ...

Splunk Custom Visualizations App End of Life

The Splunk Custom Visualizations apps End of Life for SimpleXML will reach end of support on Dec 21, 2024, ...