https://community.splunk.com/t5/Splunk-Search/How-to-append-two-different-tables-with-different-time-intervals/m-p/336767#M175271 <P>@DalJeanis<BR /> with increased data volume and with multiple fields, the initial part of the code "table _time Field1, Field2, Field3 makes the overall query to breach the search size limit, hence as an optimizing factor, by removing the part, still we get the same set of result. kindly let me know if this practice is allowed?</P> Fri, 31 Mar 2017 12:50:29 GMT sundarrajan 2017-03-31T12:50:29Z https://community.splunk.com/t5/Splunk-Search/How-to-append-two-different-tables-with-different-time-intervals/m-p/336762#M175266 <P>Hi all.<BR /> Apologies for asking such an unclear and hazy question. I have a situation to show transactions in 2 different time references. The 1st part of the table where i am showing transaction at application level (APP name) with <STRONG>time <EM>bucket _time span=15m</EM> ** and I also need to show what is the peak transaction count in last 1sec for the identified APP name. I tried **appendcols</STRONG> and then had a separate search for peak value at <STRONG>bucket _time span=1s</STRONG>. But when i downloaded the report I couldnt get the table structure clearly. The last column is going beyond the time column as per the primary search. <BR /> So how to ensure, we get a peak value transaction as the later half despite showing value of count in a 15mins window?</P> Mon, 06 Mar 2017 09:47:30 GMT https://community.splunk.com/t5/Splunk-Search/How-to-append-two-different-tables-with-different-time-intervals/m-p/336762#M175266 sundarrajan 2017-03-06T09:47:30Z https://community.splunk.com/t5/Splunk-Search/How-to-append-two-different-tables-with-different-time-intervals/m-p/336763#M175267 <P>Try this...</P> <PRE><CODE>your base search | table _time APP_name | bin _time as bin1s span=1s | stats count as count1s by APP_name bin1s | bin bin1s as bin15m span=15m | stats sum(count1s) as count, max(count1s) as "peak second", by bin15m | rename bin15m as _time </CODE></PRE> <P>All the bin renames of _time are not actually necessary, but I thought they would make the code less confusing to you. The big concept here is, first bin and aggregate at the lower level, then select out the peak second when you are doing the higher-level aggregation.</P> <P>Here's the code without any renames...</P> <PRE><CODE>your base search | table _time APP_name | bin _time span=1s | stats count as count1s by APP_name _time | bin _time span=15m | stats sum(count1s) as count, max(count1s) as "peak second", by _time </CODE></PRE> Mon, 06 Mar 2017 15:46:05 GMT https://community.splunk.com/t5/Splunk-Search/How-to-append-two-different-tables-with-different-time-intervals/m-p/336763#M175267 DalJeanis 2017-03-06T15:46:05Z https://community.splunk.com/t5/Splunk-Search/How-to-append-two-different-tables-with-different-time-intervals/m-p/336764#M175268 <P>Did this solve your issue, or do you still need help?</P> Tue, 14 Mar 2017 02:58:53 GMT https://community.splunk.com/t5/Splunk-Search/How-to-append-two-different-tables-with-different-time-intervals/m-p/336764#M175268 DalJeanis 2017-03-14T02:58:53Z https://community.splunk.com/t5/Splunk-Search/How-to-append-two-different-tables-with-different-time-intervals/m-p/336765#M175269 <P>Dear DalJeanis,</P> <P>Thanks for the quick solution. It really works for me (2nd solution over 1st). Grouping by "bins" is not clearly working. Hence I preferred grouping by time. </P> Tue, 14 Mar 2017 06:21:51 GMT https://community.splunk.com/t5/Splunk-Search/How-to-append-two-different-tables-with-different-time-intervals/m-p/336765#M175269 sundarrajan 2017-03-14T06:21:51Z https://community.splunk.com/t5/Splunk-Search/How-to-append-two-different-tables-with-different-time-intervals/m-p/336766#M175270 <P>Dear DalJeanis,<BR /> Apologies for a delay in response. I tested the code, and it works well for me. Thanks for sharing the logic. </P> Tue, 14 Mar 2017 06:22:40 GMT https://community.splunk.com/t5/Splunk-Search/How-to-append-two-different-tables-with-different-time-intervals/m-p/336766#M175270 sundarrajan 2017-03-14T06:22:40Z https://community.splunk.com/t5/Splunk-Search/How-to-append-two-different-tables-with-different-time-intervals/m-p/336767#M175271 <P>@DalJeanis<BR /> with increased data volume and with multiple fields, the initial part of the code "table _time Field1, Field2, Field3 makes the overall query to breach the search size limit, hence as an optimizing factor, by removing the part, still we get the same set of result. kindly let me know if this practice is allowed?</P> Fri, 31 Mar 2017 12:50:29 GMT https://community.splunk.com/t5/Splunk-Search/How-to-append-two-different-tables-with-different-time-intervals/m-p/336767#M175271 sundarrajan 2017-03-31T12:50:29Z