Answer by warren for How to combine count from two different mstats in where clause Splunk?

Per the docs.Splunk entry for mstats, you can append another mstats call. So something like this should work:

| mstats count(_value) as count2 WHERE metric_name="*metric2*" AND metric_type=c AND status="success" by metric_name,env,status
| where count2=0
| append
    [| mstats count(_value) as count1 WHERE metric_name="*metric1*" AND metric_type=c AND status="success" by metric_name,env,status
    | where count1>0 ]

You should then be able to post-process the appended search results as desired

from User warren – Stack Overflow https://stackoverflow.com/questions/73223933/how-to-combine-count-from-two-different-mstats-in-where-clause-splunk/73226482#73226482
via IFTTT

merikebi

warrenmyers.com