topic Re: Appending tables in searches in Knowledge Management

Appending tables in searches

SplnkUse — Fri, 05 Nov 2021 23:27:29 GMT

Hello

Is it possible to append two searches?

I have a search that ends in:

| table A B C

And I want to append to the above some values under A, B, C that I calculate.

Can you tell me please the syntax for that?

Thanks!

Re: Appending tables in searches

ITWhisperer — Fri, 05 Nov 2021 23:30:04 GMT

search | table A B C | append [search | table A B C]

Re: Appending tables in searches

SplnkUse — Sun, 28 Nov 2021 01:14:31 GMT

@ITWhisperer thanks but I cannot make it work, it seems it does not keep aliases within the brackets and run the whole thing as one, instead of each separately and then join, is there any solution?

Re: Appending tables in searches

ITWhisperer — Sun, 28 Nov 2021 07:34:47 GMT

What is the actual search that you are using?

Re: Appending tables in searches

SplnkUse — Mon, 13 Dec 2021 11:23:26 GMT

@ITWhisperer thanks, I am trying to combine searches in the following format. I know it may be difficult to picture the below but I cannot post more exact data.

I think the problem is that the:

eval a="aaa"

is contained in two different searches and is set to different values.

Any idea?

Re: Appending tables in searches

ITWhisperer — Mon, 13 Dec 2021 12:42:18 GMT

This is the right sort of syntax - what is the issue you are facing with doing it this way?

Re: Appending tables in searches

ldongradi_SPL — Wed, 15 Dec 2021 20:34:34 GMT

| append [...] will append the inner search results to the outer search. For example: index=foo | stats count | append [index=bar | stats count]

| appendpipe [...] will prolongate the outer search with the inner search modifications, and append the results instead of replacing them. For example: ... | appendpipe [ | stats count as extracount]

| eventstats ... will add extra columns to an existing table with a treatment like a stats, without any further transformation. For example | eventstats avg(bytes) by server

| streamstats ... will add extra columns to an existing table, but each calculated result depend on the previous results. For example: | streamstats count as rank

For your needs, append may not be what you're looking for. The 2 searches are independant.

Re: Appending tables in searches

PickleRick — Wed, 15 Dec 2021 20:40:37 GMT

The syntax looks ok, but each of your subsearches returns different set of fields. If you want to have three columns as output, you have to return the same set of fields from each of subsearches. Do a rename at the end of your subsearches so that the returned fields are named consistently.