https://community.splunk.com/t5/Splunk-Search/append-searches/m-p/158853#M44790 <P>remember that the sub search for the append is limited to 10000 results.</P> Sun, 27 Jul 2014 23:11:15 GMT yannK 2014-07-27T23:11:15Z https://community.splunk.com/t5/Splunk-Search/append-searches/m-p/158851#M44788 <P>I appended 2 searches and each of them has "top Engineer" and now my result is like this.</P> <P>Engineer Escalated Closed</P> <P>Shaun 61<BR /> Smith 53<BR /> Arun 41<BR /> Sam 19<BR /> John 14<BR /> Jason 13<BR /> Eddy 12<BR /> Rich 9<BR /> Arun 114<BR /> John 93<BR /> Shaun 76<BR /> Eddy 74<BR /> Jason 46<BR /> Rich 38<BR /> Smith 16<BR /> Sam 12</P> <P>How can I have a result like this ?<BR /> Engineer Escalated Closed</P> <P>Shaun 61 76<BR /> Smith 53 16<BR /> Arun 41 114<BR /> Sam 19 12<BR /> John 14 93<BR /> Jason 13 46<BR /> Eddy 12 74<BR /> Rich 9 38</P> Sun, 27 Jul 2014 14:42:30 GMT https://community.splunk.com/t5/Splunk-Search/append-searches/m-p/158851#M44788 karthik4455 2014-07-27T14:42:30Z https://community.splunk.com/t5/Splunk-Search/append-searches/m-p/158852#M44789 <P>You could do one of two things:</P> <PRE><CODE>search one | append [search two] | stats values(Escalated) as Escalated values(Closed) as Closed by Engineer search one | join Engineer [search two] </CODE></PRE> <P>The second approach will only work if the set of engineers in both searches is identical.</P> <P>There probably is a third way to avoid the need to append altogether, do post your two searches so we can have a look.</P> Sun, 27 Jul 2014 14:58:40 GMT https://community.splunk.com/t5/Splunk-Search/append-searches/m-p/158852#M44789 martin_mueller 2014-07-27T14:58:40Z https://community.splunk.com/t5/Splunk-Search/append-searches/m-p/158853#M44790 <P>remember that the sub search for the append is limited to 10000 results.</P> Sun, 27 Jul 2014 23:11:15 GMT https://community.splunk.com/t5/Splunk-Search/append-searches/m-p/158853#M44790 yannK 2014-07-27T23:11:15Z