topic Re: How to add result of multiple searches to a single table in Dashboards & Visualizations

How to add result of multiple searches to a single table

Aakanksha — Wed, 23 Jan 2013 12:27:03 GMT

for example suppose i have a search query which gives me results avg1 and name1,
and second search which gives a result avg2 and name2

now I want to create a table which contains these values of search1 & search2 as avgs and names

thanks..

[Edit]
Query1--
... eval add = x+y+z |eval name="xyz"|stats avg(add) as avg1

Query2--
... eval add=d+e+f | eval name="abc"|stats avg(add) as avg2

now-- result should be

name avg

-----------

xyz avg1

abc avg2

Re: How to add result of multiple searches to a single table

lpolo — Wed, 23 Jan 2013 13:45:20 GMT

You may use the search command appendcols.
More information:

http://docs.splunk.com/Documentation/Splunk/latest/SearchReference/Appendcols

your_search_query_1|
appendcols [search your_search_query_2]|

Re: How to add result of multiple searches to a single table

MuS — Wed, 23 Jan 2013 13:52:30 GMT

Hi Aakanksha

you can do this by using join or with append and run two searches at once. The append command will not work on real-time searches.

example:

first | join [search second]

cheers,
MuS

Re: How to add result of multiple searches to a single table

jonuwz — Wed, 23 Jan 2013 13:58:13 GMT

Are they saved searches ?

Re: How to add result of multiple searches to a single table

Aakanksha — Wed, 23 Jan 2013 14:20:41 GMT

I have updated my question..and also i tried using appendcols but not sure whether i am using it correctly or not

Re: How to add result of multiple searches to a single table

Aakanksha — Wed, 23 Jan 2013 14:32:12 GMT

i think join works on some common fields but i don't have any common field..plz correct me if i m wrong ..

Re: How to add result of multiple searches to a single table

MuS — Wed, 23 Jan 2013 14:41:44 GMT

yes, join works only on common fields in both searches

Re: How to add result of multiple searches to a single table

rtadams89 — Wed, 23 Jan 2013 14:48:28 GMT

As previously mentioend you can use "append" or "appendcols", or you can use "join". If you use "join", you will need a common field to join on, but this can easily be accomplished by adding ... | eval joinOn="blahblahblah" to both searches, then use the new field "joinOn" (which has the same value in both searchs) as the field to join on.

I imagine you probably want to use append or appendcols though...