I have two different fields (DB_INSTANCE_NAME & INSTANCE_NAME ) in two source types. These fields contain a similar value. I want distinct counts after combining both pieces of field data.
DB_INSTANCE_NAME= ansrp, flexp, sunopt, vlprod, buybprod, FDPOSPRD, aasprod, dcpscp, hydra, cidprod, gcdprd, pspprod, HDMPRD
INSTANCE_NAME= obieep, cnavprd, gcdprd, pspprod, svdprod, tumss2, fepauth, rulesu, ecmsprod, HDMPRD, csprod, RFEP1, pcip, vlprod
I want the count of ansrp, flexp, sunopt, vlprod, buybprod, FDPOSPRD, aasprod, dcpscp, hydra, cidprod, gcdprd, pspprod, HDMPRD, obieep, cnavprd, svdprod, tumss2, fepauth, rulesu, ecmsprod, HDMPRD, csprod, RFEP1, pcip
What you do is combine them then count them.
index=foo (sourcetype=st1 OR sourcetype=st2) | eval combinedField=coalesce(DB_INSTANCE_NAME, INSTANCE_NAME) | stats dc(combinedField) as Count
Credit goes to @micahkemp:
| stats dc(eval(mvappend(field1, field2, field3)))
What you do is combine them then count them.
index=foo (sourcetype=st1 OR sourcetype=st2) | eval combinedField=coalesce(DB_INSTANCE_NAME, INSTANCE_NAME) | stats dc(combinedField) as Count