Answer by warren for How to merge two stats by in Splunk?

This may be what you are looking for

index="cumu_open_csv"  Assignee="ram"
| eval open_field=if(in(Status,"Open","Reopened","Waiting","In Progress"), 1,0)
| stats count(eval(open_field=1)) AS Open, count(eval(open_field=0)) AS closed by CW_Created
| rename CW_Created as CW
| join type=outer CW
    [| search index="cumu_open_csv"  Assignee="ram"
    | eval open_field=if(in(Status,"Open","Reopened","Waiting","In Progress"), 1,0)
    | stats count(eval(open_field=1)) As DueOpen by CW_DueDate
    | rename CW_DueDate as CW ]

from User warren – Stack Overflow https://stackoverflow.com/questions/63132733/how-to-merge-two-stats-by-in-splunk/63134233#63134233
via IFTTT

merikebi

warrenmyers.com