index="indexsplunk" host=host* tag="Failure" "Transaction" | stats count as Total
|append [search index="indexsplunk" host=host* tag="Failure" "EFGH" | stats count as Total]
Right now, output is displaying in 2 rows, since I append so one more row added for 2nd search. Please help me getting the data populated in one field and also suggest how to add the date while searching.
try this:
(index="indexsplunk" host=host* tag="Failure" "Transaction" ) OR (index="indexsplunk" host=host* tag="ABCD" "EFGH")
| stats count(eval(tag=="Failure")) as fail_count count(eval(tag=="ABCD")) as adcd_count
Hi, it gives me the 0 result, actually tag is common for both, can you please check again.
try and use this formula, here i use wild cards in eval %Fail%
you might not need.
| makeresults count=1000
| eval random_for_text = random()%2
| eval text_to_search = if(random_for_text=="0","Failure","EFGH")
| stats count(eval(like(text_to_search,"%Fail%"))) as fail_count count(eval(like(text_to_search, "%EF%"))) as efgh_count
in your case itll be maybe something like this:
index="indexsplunk" host=host* tag="Failure" "Transaction" ("Failure" OR "EFGH")
| stats count(eval(like(_raw,"Failure"))) as fail_count count(eval(like(_raw, "EFGH"))) as efgh_count
hope it helps
Do the two rows have anything in common?
Yes, Index, Host and Tag are common, please help