I would like to construct a bar graph comparing login events between two applications however I'm having trouble joining my two search queries. They both rely on count as I simply need to count the number of login events per application.
I believe the associated table would need to be output like so:
Application name | Login count
APP1 | 10
APP2 | 22
index=tracking_all topic="DATA.TRACKING.DEBATCHED.APP1" payload.props.schema="*login*"
| stats count as APP1
| join count [search index=tracking_all topic="DATA.TRACKING.DEBATCHED.APP2" payload.props.schema="*login*" | stats count as APP2]
... View more