https://community.splunk.com/t5/Splunk-Search/Joining-Tables/m-p/584348#M203487 <P>Hello,&nbsp;</P><P>I need your help please, I have two tables resulting from two searches and I need to join these two tables to make a cumulative bar chart according to date.</P><P>My tables are&nbsp;</P><P><span class="lia-inline-image-display-wrapper lia-image-align-inline" image-alt="crmarley20_0-1644425055153.png" style="width: 400px;"><img src="https://community.splunk.com/t5/image/serverpage/image-id/17897i3623B996C7EEF8B4/image-size/medium?v=v2&amp;px=400" role="button" title="crmarley20_0-1644425055153.png" alt="crmarley20_0-1644425055153.png" /></span><BR /><BR /></P><P><span class="lia-inline-image-display-wrapper lia-image-align-inline" image-alt="crmarley20_1-1644425077542.png" style="width: 400px;"><img src="https://community.splunk.com/t5/image/serverpage/image-id/17898iAB68FD807E02F7A9/image-size/medium?v=v2&amp;px=400" role="button" title="crmarley20_1-1644425077542.png" alt="crmarley20_1-1644425077542.png" /></span></P><P>What I want to achieve is:<BR /><BR /></P><TABLE border="1" width="86.22449240881645%"><TBODY><TR><TD width="14.285714285714286%" height="25px">Datum</TD><TD width="14.285714285714286%" height="25px">A1</TD><TD width="14.285714285714286%" height="25px">A2</TD><TD width="14.285714285714286%" height="25px">A3</TD><TD width="14.285714285714286%" height="25px">A4</TD><TD width="14.285714285714286%" height="25px">A5</TD><TD width="7.142857142857143%" height="25px">A6</TD></TR><TR><TD height="25px">2022-02-08</TD><TD height="25px">5.7</TD><TD height="25px">&nbsp;</TD><TD height="25px">3.7</TD><TD height="25px">1.9</TD><TD height="25px">4.56</TD><TD height="25px">90.3</TD></TR></TBODY></TABLE><P>&nbsp;</P><P>&nbsp;</P><P>&nbsp;</P> Wed, 09 Feb 2022 16:48:41 GMT crmarley20 2022-02-09T16:48:41Z https://community.splunk.com/t5/Splunk-Search/Joining-Tables/m-p/584348#M203487 <P>Hello,&nbsp;</P><P>I need your help please, I have two tables resulting from two searches and I need to join these two tables to make a cumulative bar chart according to date.</P><P>My tables are&nbsp;</P><P><span class="lia-inline-image-display-wrapper lia-image-align-inline" image-alt="crmarley20_0-1644425055153.png" style="width: 400px;"><img src="https://community.splunk.com/t5/image/serverpage/image-id/17897i3623B996C7EEF8B4/image-size/medium?v=v2&amp;px=400" role="button" title="crmarley20_0-1644425055153.png" alt="crmarley20_0-1644425055153.png" /></span><BR /><BR /></P><P><span class="lia-inline-image-display-wrapper lia-image-align-inline" image-alt="crmarley20_1-1644425077542.png" style="width: 400px;"><img src="https://community.splunk.com/t5/image/serverpage/image-id/17898iAB68FD807E02F7A9/image-size/medium?v=v2&amp;px=400" role="button" title="crmarley20_1-1644425077542.png" alt="crmarley20_1-1644425077542.png" /></span></P><P>What I want to achieve is:<BR /><BR /></P><TABLE border="1" width="86.22449240881645%"><TBODY><TR><TD width="14.285714285714286%" height="25px">Datum</TD><TD width="14.285714285714286%" height="25px">A1</TD><TD width="14.285714285714286%" height="25px">A2</TD><TD width="14.285714285714286%" height="25px">A3</TD><TD width="14.285714285714286%" height="25px">A4</TD><TD width="14.285714285714286%" height="25px">A5</TD><TD width="7.142857142857143%" height="25px">A6</TD></TR><TR><TD height="25px">2022-02-08</TD><TD height="25px">5.7</TD><TD height="25px">&nbsp;</TD><TD height="25px">3.7</TD><TD height="25px">1.9</TD><TD height="25px">4.56</TD><TD height="25px">90.3</TD></TR></TBODY></TABLE><P>&nbsp;</P><P>&nbsp;</P><P>&nbsp;</P> Wed, 09 Feb 2022 16:48:41 GMT https://community.splunk.com/t5/Splunk-Search/Joining-Tables/m-p/584348#M203487 crmarley20 2022-02-09T16:48:41Z https://community.splunk.com/t5/Splunk-Search/Joining-Tables/m-p/584352#M203489 <P>What are your two searches?</P> Wed, 09 Feb 2022 17:12:39 GMT https://community.splunk.com/t5/Splunk-Search/Joining-Tables/m-p/584352#M203489 ITWhisperer 2022-02-09T17:12:39Z https://community.splunk.com/t5/Splunk-Search/Joining-Tables/m-p/584455#M203514 <P>Something like this:</P><LI-CODE lang="markup">&lt;first table's search&gt; | chart sum(mid_result) over segment | append [| search &lt;second table's search&gt;] | stats sum(*) as * by Schiche_Datum | rename Schiche_Datum as Datum</LI-CODE><P>Kindly ignore typos and fix column names if I mis-typed it.</P> Thu, 10 Feb 2022 06:58:10 GMT https://community.splunk.com/t5/Splunk-Search/Joining-Tables/m-p/584455#M203514 VatsalJagani 2022-02-10T06:58:10Z https://community.splunk.com/t5/Splunk-Search/Joining-Tables/m-p/584461#M203519 <P>Hello</P><P>You have two different formatted tables. You might want to transform the structure either on first search or second.&nbsp;</P><P>&nbsp;</P><LI-CODE lang="markup">first_search | join type=left Schicht_Datum [ second_search | untable Schicht_Datum segment mid_result ] | xyseries Schicht_Datum segment mid_result</LI-CODE><P>&nbsp;</P><P>&nbsp;</P> Thu, 10 Feb 2022 07:15:28 GMT https://community.splunk.com/t5/Splunk-Search/Joining-Tables/m-p/584461#M203519 BahadirS 2022-02-10T07:15:28Z