https://community.splunk.com/t5/Splunk-Search/Column-Merging-how-to/m-p/103936#M26884 <P>The below search script successfully charts one table with two separate set of search results each has the individual <SITE id=""> columns. Trouble is, we need the <SITE id=""> column as merged into one column. Note that not each event type has a result, thus some of the events will have null entry.<BR /> Does anyone can light my way? <BR /> Thanks.<BR /> Here is the search script I am using.</SITE></SITE></P> <PRE><CODE>eventType="event1" | chart count(eval(time&lt;4000)) as event1LessThan4Sec, count as TotalCount1 by siteID | rename siteID as "ID for 1" | eval SLAsMet1=event1LessThan4Sec/TotalCount1 | appendcols [ search eventType="event2" | chart count(eval(time&lt;2000)) as event2LessThan2Sec, count as TotalCount2 by siteID | rename siteID as "ID for 2" | eval SLAsMet2=event2LessThan2Sec/TotalCount2 ] </CODE></PRE> Wed, 18 May 2011 14:40:32 GMT bilgin 2011-05-18T14:40:32Z https://community.splunk.com/t5/Splunk-Search/Column-Merging-how-to/m-p/103936#M26884 <P>The below search script successfully charts one table with two separate set of search results each has the individual <SITE id=""> columns. Trouble is, we need the <SITE id=""> column as merged into one column. Note that not each event type has a result, thus some of the events will have null entry.<BR /> Does anyone can light my way? <BR /> Thanks.<BR /> Here is the search script I am using.</SITE></SITE></P> <PRE><CODE>eventType="event1" | chart count(eval(time&lt;4000)) as event1LessThan4Sec, count as TotalCount1 by siteID | rename siteID as "ID for 1" | eval SLAsMet1=event1LessThan4Sec/TotalCount1 | appendcols [ search eventType="event2" | chart count(eval(time&lt;2000)) as event2LessThan2Sec, count as TotalCount2 by siteID | rename siteID as "ID for 2" | eval SLAsMet2=event2LessThan2Sec/TotalCount2 ] </CODE></PRE> Wed, 18 May 2011 14:40:32 GMT https://community.splunk.com/t5/Splunk-Search/Column-Merging-how-to/m-p/103936#M26884 bilgin 2011-05-18T14:40:32Z https://community.splunk.com/t5/Splunk-Search/Column-Merging-how-to/m-p/103937#M26885 <P>So you just want one field containing the value of either "ID for 1" or "ID for 2", with the assumption that only one of them will contain a value ?</P> <P>If so, you can always use something like:</P> <PRE><CODE>| eval siteID=coalesce("ID for 1", "ID for 2") </CODE></PRE> Wed, 18 May 2011 15:17:24 GMT https://community.splunk.com/t5/Splunk-Search/Column-Merging-how-to/m-p/103937#M26885 southeringtonp 2011-05-18T15:17:24Z