How to edit my search to find the counts for "heap dump" and "java core" fields by host?

[harishnpandey]

trying to list Heapdump and javacore counts across multiple hosts

Splunk search

host=A OR host=B OR host=C OR host=D "JVM requested Java dump" |stats count as Java_Dump by host | appendcols [search host=A OR host=B OR host=C OR host=D]  "JVM requested Heap dump"|stats count as Heap_Dump by host

This one is not working for me ..Appreciate any suggestion to this

Also, I tried below one .. It return values for both Java dump and Heap dump but its giving wrong count and patterns

host=A OR host=B OR host=C OR host=D  |stats count(eval(searchmatch("JVM requested Java dump"))) as Java_Dump count(eval(searchmatch("JVM requested Heap dump"))) as Heap_Dump by host

[somesoni2]

Your first search has syntax error (square bracket in wrong place). Correct search will be this

host=A OR host=B OR host=C OR host=D "JVM requested Java dump" |stats count as Java_Dump by host | appendcols [search host=A OR host=B OR host=C OR host=D  "JVM requested Heap dump"|stats count as Heap_Dump by host]

This version has several issues, like running search on same data twice, subsearch limitations may apply, and if one of the host doesn't have that string, the column ordering would be wrong. A better approach would be like this

host=A OR host=B OR host=C OR host=D ( "JVM requested Java dump" OR "JVM requested Heap dump") 
| eval Java_Dump=if(searchmatch( "JVM requested Java dump"),1,0)
| eval Heap_Dump=if(searchmatch( "JVM requested Heap dump"),1,0)
| stats sum(*_Dump) as *_Dump by host

[harishnpandey]

Thank you very much. First query gives me now correct output. However .2nd one still

[woodcock]

I am skeptiful in the extreme. The 2nd search is impeccable; it absolutely is correct. How are you determining otherwise?