My search string is
host=ABC| append [search host=DEF]|stats sum(V) by "ER Code"
Can I have a count function also with search.Count should by calculated based on another field.
Ex:host=ABC| append [search host=DEF]|stats sum(V) by "ER Code"|stats count(I) by "User"
Is it possible to achieve this result.
Your sample search does not really make sense.
host=ABC | append [search host=DEF]
is the same as
host=ABC or host=DEF
Sample events and a sketch of the desired output would be better if you want more qualified help.
/k