Splunk Search

How to combine 2 stats count O/P to be displayed in one for use in Overlay Chart

promukh
Path Finder

search query 1 | stats count by source1.field1 | where blah ==blah | rename field1 as "Y-098"

Y-098 || Count
1.Instagram -- 56
2.twitter -- 78

search query 2 | stats count by source2.field2 | where blah ==blah | rename field2 as "Vr-234"

Vr-234 || Count
1.Instagram_active_user -- 34
2.twitter_active_user --21

How can i combine the above 2 searches to be displayed under one output as shown below to be used in Overlay Chart , also is there any way to rename the "Count" Field

Field-Name-1 | Count | Field-Name-2 | Count
Instagram | 56 | Instagram_active_user | 34
twitter | 78 | twitter_active_user | 21

0 Karma

woodcock
Esteemed Legend

Like this:

(search query 1) OR (search query 2)
| eval joiner=coalesce(source1.field1, source2.field2)
| stats count BY joiner
| eval {joiner} = count
| table joiner count *_active_user
| eventstats first(*_active_user) AS *_active_user
| foreach *_active_user [ eval active_user_count = if(joiner=="<<MATCHSTR>>", '<<FIELD>>', active_user_count) | fields - <<FIELD>> ]
| where isnotnull(active_user_count)

sumanssah
Communicator

Please try this

search query 1 | stats count by source1.field1 | where blah ==blah | rename field1 as "Y-098" 

| join 
    [| search query 2 | stats count by source2.field2 | where blah ==blah | rename field2 as "Vr-234" ]
0 Karma
Get Updates on the Splunk Community!

Announcing Scheduled Export GA for Dashboard Studio

We're excited to announce the general availability of Scheduled Export for Dashboard Studio. Starting in ...

Extending Observability Content to Splunk Cloud

Watch Now!   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to leverage ...

More Control Over Your Monitoring Costs with Archived Metrics GA in US-AWS!

What if there was a way you could keep all the metrics data you need while saving on storage costs?This is now ...