Merge results of two different searches

[christo16]

Hello! I have two fields named differently, containing the same data, that I would like to merge.

I'd like to basically merge the results of these two separate searches to one result:
1) index= sourcetype= | stats count by client_ver
2) index= sourcetype= | stats count by Version

Is this possible?

[christo16]

Thanks for asking. So the data in both client_var and version is the same. We changed the field name at some point. Does this make sense?

[sideview]

How would you like the final data to be merged? There are several ways. For instance would you like three fields: Version, count (as client), count (as server)?
or does the distinction of client vs not-client not really matter and you just want an overall count of the versions regardless of whether the value was a client version or not?

[christo16]

The source index and types are the same

[sideview]

Well.. it depends on some more details. Like whether the indexes and sourcetypes are the same in the two searches, and what you want the final output of the single search to look like.

If the indexes and sourcetypes are the same in the two searches, then

index=<some_index> sourcetype=<some_source> | stats count by client_ver Version

will give you one result with all the unique combinations of client_ver and Version.

If you're asking because you want to feed one search result to two different charts or tables on a dashboard, you would use 'postprocess' searches to carve this larger unified result into two different chartable results. Those 'postprocess' searches would each look like

| stats sum(count) as count by Version  

If the sourcetypes and indexes are different, then it's still very possible but you go about it a slightly different way. Can you post more details and I can update my answer as appropriate?

UPDATE-----------------------------

Ah! I see. it literally is exactly the same data and exactly the same space of field values, and it's just that the field name changed over time.

You can just use the eval command to normalize them at search time.

index=<some_index> sourcetype=<some_source> |  eval Version=coalesce(client_ver, Version) | stats count by Version

http://docs.splunk.com/Documentation/Splunk/latest/SearchReference/CommonEvalFunctions