query 1: index=lenovo sourcetype = ticketmaster | where Status in ("Assigned","In-Progress","New","Pending")
| stats dc(No) as LENOVO_COUNT by Status
query 2: sourcetype="remedy_incident" OR sourcetype="remedy_incident_task"
| where state in(1,2,14,16,18,22,40,62)
| eval Status = case(state = "1","New",state = "2","Active",state = "14","Pending",state = "16","Pending",state = "18","Pending",state = "22","Pending",state = "40","Pending",state = "62","Pending") | stats dc(number) as REMEDY_COUNT by Status
Try this:
(index=lenovo sourcetype = ticketmaster) OR (sourcetype="remedy_incident" OR sourcetype="remedy_incident_task")
| where (Status IN("Assigned","In-Progress","New","Pending") OR state IN(1,2,14,16,18,22,40,62))
| eval Status = case(sourcetype = ticketmaster, Status, state = "1","New",state = "2","Active",state = "14","Pending",state = "16","Pending",state = "18","Pending",state = "22","Pending",state = "40","Pending",state = "62","Pending")
| stats dc(No) AS LENOVO_COUNT dc(number) AS REMEDY_COUNT BY Status
Hi @dhirajyadav,
How do you want to combine? What should be the final result?