https://community.splunk.com/t5/Splunk-Search/How-to-only-append-the-event-based-on-the-existing-records-from/m-p/428443#M122584 <P>Hi.</P> <P>i have a search which need to combine fields from two index. i know i can use "Join" but it is too costly thats why i start looking into the "Append" command.</P> <P>The question is i found i have to enter the field value in the "append search" to get the correct final table, if i dont put the value in the append search, this field will missing in the final table. Below i have attached some of the code.</P> <P>index=year* Code=12 OR Code=13 <STRONG>Number=12345678</STRONG><BR /> | rex ****************<BR /> | rex ****************<BR /> | eval *******************<BR /> | eval 001=xxxxx<BR /> | append <BR /> [search index=month* Word=xys OR word=ayd <STRONG>Number=12345678</STRONG>| fields + day week time]<BR /> | rex ****************<BR /> | rex ****************<BR /> | eval *******************<BR /> | eval 002=xxxxxxx<BR /> | stats<BR /> first(001) as 001<BR /> first(002) as 002<BR /> by Number<BR /> |table 001 002</P> <P>The code above works find but once i remove the <STRONG>Number=12345678</STRONG> in the append search, the 002 field which is from the Append search cannot show in the table, and all the remaining events in index=month* will show in the table. is it possible to solve this? thanks a lot!!</P> Fri, 25 Jan 2019 09:30:06 GMT xzywind 2019-01-25T09:30:06Z https://community.splunk.com/t5/Splunk-Search/How-to-only-append-the-event-based-on-the-existing-records-from/m-p/428443#M122584 <P>Hi.</P> <P>i have a search which need to combine fields from two index. i know i can use "Join" but it is too costly thats why i start looking into the "Append" command.</P> <P>The question is i found i have to enter the field value in the "append search" to get the correct final table, if i dont put the value in the append search, this field will missing in the final table. Below i have attached some of the code.</P> <P>index=year* Code=12 OR Code=13 <STRONG>Number=12345678</STRONG><BR /> | rex ****************<BR /> | rex ****************<BR /> | eval *******************<BR /> | eval 001=xxxxx<BR /> | append <BR /> [search index=month* Word=xys OR word=ayd <STRONG>Number=12345678</STRONG>| fields + day week time]<BR /> | rex ****************<BR /> | rex ****************<BR /> | eval *******************<BR /> | eval 002=xxxxxxx<BR /> | stats<BR /> first(001) as 001<BR /> first(002) as 002<BR /> by Number<BR /> |table 001 002</P> <P>The code above works find but once i remove the <STRONG>Number=12345678</STRONG> in the append search, the 002 field which is from the Append search cannot show in the table, and all the remaining events in index=month* will show in the table. is it possible to solve this? thanks a lot!!</P> Fri, 25 Jan 2019 09:30:06 GMT https://community.splunk.com/t5/Splunk-Search/How-to-only-append-the-event-based-on-the-existing-records-from/m-p/428443#M122584 xzywind 2019-01-25T09:30:06Z