Hi -
I have two searches that have the same fields exactly but from different sources.
I would like to join and sum the results and output
The searches:
index="atti" sourcetype="strongmail" source="/data1/strongmail/log/strongmail-retryfailed.log" mailingclass="smtpvhost1.yp.com"|stats count as NumberFailed by MailingId,Bouncetype
MailingId, Bouncetype, NumberFailed
12121,2004,2
12058,3004,4
index="atti" sourcetype="strongmail" source="/data1/strongmail/log/strongmail-failed.log" mailingclass="smtpvhost1.yp.com" |stats count as NumberFailed by MailingId,Bouncetype
MailingId, Bouncetype, NumberFailed
12121,2004,4
12058,3004,6
They return exactly as you see the same columns, I want combine(Sum) the results and output:
MailingId, Bouncetype, NumberFailed
12121,2004,6
12058,3004,10
Thanks.
Like this:
index="atti" sourcetype="strongmail" mailingclass="smtpvhost1.yp.com" (source="/data1/strongmail/log/strongmail-retryfailed.log" OR source="/data1/strongmail/log/strongmail-failed.log") |stats count as NumberFailed by MailingId,Bouncetype
Hi rajadatta
Try the following query :
|set union [search index="atti" sourcetype="strongmail" source="/data1/strongmail/log/strongmail-retryfailed.log" mailingclass="smtpvhost1.yp.com"|stats count as NumberFailed by MailingId,Bouncetype ] [search index="atti" sourcetype="strongmail" source="/data1/strongmail/log/strongmail-failed.log" mailingclass="smtpvhost1.yp.com" |stats count as NumberFailed by MailingId,Bouncetype ]|stats sum(NumberFailed) as total_NumberFailed
Thanks for the help. I went with the first answer as it was what I was looking for.
Thanks this gives me the total failed as count. I can use this as well for another report.
Like this:
index="atti" sourcetype="strongmail" mailingclass="smtpvhost1.yp.com" (source="/data1/strongmail/log/strongmail-retryfailed.log" OR source="/data1/strongmail/log/strongmail-failed.log") |stats count as NumberFailed by MailingId,Bouncetype
Thanks this is what I needed.