https://community.splunk.com/t5/Splunk-Search/Union-of-two-fields/m-p/146963#M41064 <P>It's not clear what you want the output to be. This will show all the combinations of field1 and field2 in your data.</P> <PRE><CODE>&lt;your search&gt; | dedup field1 field2 | ... </CODE></PRE> Mon, 08 Dec 2014 14:57:20 GMT richgalloway 2014-12-08T14:57:20Z https://community.splunk.com/t5/Splunk-Search/Union-of-two-fields/m-p/146961#M41062 <P>I have a query that produces results that has two columns :</P> <PRE><CODE>| field1 | field2 | </CODE></PRE> <P>Field1 &amp; Field2 have same domain, i.e. takes same set of values. I need to find out Union of the distinct values from both fields.</P> <P>Any ideas?</P> Mon, 08 Dec 2014 12:13:44 GMT https://community.splunk.com/t5/Splunk-Search/Union-of-two-fields/m-p/146961#M41062 mohitab 2014-12-08T12:13:44Z https://community.splunk.com/t5/Splunk-Search/Union-of-two-fields/m-p/146962#M41063 <P>Something like this:</P> <PRE><CODE>...your search... | stats values(field1) as f1values values(field2) as f2values | eval allvalues=mvdedup(mvappend(f1values,f2values)) </CODE></PRE> <P>ought to work.</P> Mon, 08 Dec 2014 14:55:18 GMT https://community.splunk.com/t5/Splunk-Search/Union-of-two-fields/m-p/146962#M41063 aweitzman 2014-12-08T14:55:18Z https://community.splunk.com/t5/Splunk-Search/Union-of-two-fields/m-p/146963#M41064 <P>It's not clear what you want the output to be. This will show all the combinations of field1 and field2 in your data.</P> <PRE><CODE>&lt;your search&gt; | dedup field1 field2 | ... </CODE></PRE> Mon, 08 Dec 2014 14:57:20 GMT https://community.splunk.com/t5/Splunk-Search/Union-of-two-fields/m-p/146963#M41064 richgalloway 2014-12-08T14:57:20Z https://community.splunk.com/t5/Splunk-Search/Union-of-two-fields/m-p/146964#M41065 <P>HI<BR /> I propose this</P> <PRE><CODE>Index=… field1=*|table field1|append[search index=… field2=*|table field2]| eval allvalues=mvappend(field1,field2)|dedup allvalues |table field1 field2 allvalues |sort allvalues </CODE></PRE> Fri, 12 Dec 2014 14:09:56 GMT https://community.splunk.com/t5/Splunk-Search/Union-of-two-fields/m-p/146964#M41065 btt 2014-12-12T14:09:56Z