Quantcast
Channel: Questions in topic: "splunk-enterprise"
Viewing all articles
Browse latest Browse all 47296

Club results from multiple search in a single table.Search involves dedup and count by parameter

$
0
0
index=* activatesessionIdsForREST() : partnerId=11111111111 ActivateOfferRequestVO |dedup sessionIds|stats count(sessionIds) as SessionCount by partnerId append [search index=* activatesessionIdsForREST() : partnerId=22222222222 ActivateOfferRequestVO |dedup sessionIds|stats count(sessionIds) as SessionCount by partnerId] Above is my query I am looking for a table like PartnerId SessionCount 11111111111 10 22222222222 20 When I run the first query, I get the result separately index=* activatesessionIdsForREST() : partnerId=11111111111 ActivateOfferRequestVO |dedup sessionIds|stats count(sessionIds) as SessionCount by partnerId append I get PartnerId SessionCount 11111111111 10 but when I append the second query, I dont get results. Appreciate any suggestion

Viewing all articles
Browse latest Browse all 47296

Trending Articles



<script src="https://jsc.adskeeper.com/r/s/rssing.com.1596347.js" async> </script>