https://community.splunk.com/t5/Splunk-Search/Append-showing-result-in-new-row/m-p/167857#M47811 <P>Just needed to change <CODE>value</CODE> to <CODE>values</CODE>. And it's <CODE>5minutesago</CODE> instead of <CODE>5monthsago</CODE>. Thanks @yannK!</P> Thu, 05 Dec 2013 16:16:48 GMT mcamilleri 2013-12-05T16:16:48Z https://community.splunk.com/t5/Splunk-Search/Append-showing-result-in-new-row/m-p/167854#M47808 <P>If I understood correctly <EM>append</EM> returns the result in the same row as the previous query. Anyone knows why I get 2 separate rows in my results: 1 row with the <EM>foo</EM> number and another with the <EM>bar</EM> number? And no <EM>DiffPercent</EM>?</P> <PRE><CODE>earliest=-5m@m latest=@m &lt;my query&gt; |stats sum(eval(MessageCount)) as foo | append [search earliest=-10m@m latest=-5m@m &lt;same query&gt; |stats sum(eval(MessageCount)) as bar] | append [eval DiffPercent = (bar - foo) / bar * 100] </CODE></PRE> <P><IMG src="http://answers.splunk.com//storage/foobar.png" alt="alt text" /></P> Thu, 05 Dec 2013 15:36:08 GMT https://community.splunk.com/t5/Splunk-Search/Append-showing-result-in-new-row/m-p/167854#M47808 mcamilleri 2013-12-05T15:36:08Z https://community.splunk.com/t5/Splunk-Search/Append-showing-result-in-new-row/m-p/167855#M47809 <P>Yes this is what <CODE>append</CODE> does, append row of results after the existing ones.</P> <P>If you want to add columns, you may want to look at <CODE>appendcols</CODE> (but they may not be aligns)<BR /> or the <CODE>join</CODE> function (using a common field for the join)</P> <P>Or simply use the <CODE>append</CODE>, adding an extra <CODE>stats</CODE> or <CODE>timechart</CODE> after to reformat.</P> <P><CODE>earliest=-5m@m latest=@m &lt;my query&gt; <BR /> |stats sum(eval(MessageCount)) as foo <BR /> | eval title="5monthsago"<BR /> | append [ <BR /> search earliest=-10m@m &lt;same query&gt; <BR /> |stats sum(eval(MessageCount)) as bar <BR /> | eval title="10monthsago"<BR /> ] <BR /> | stats values(foo) AS foo values(bar) AS bar <BR /> | eval DiffPercent = (bar - foo) / bar * 100<BR /> </CODE></P> <P>[edit value to values]</P> Thu, 05 Dec 2013 16:00:00 GMT https://community.splunk.com/t5/Splunk-Search/Append-showing-result-in-new-row/m-p/167855#M47809 yannK 2013-12-05T16:00:00Z https://community.splunk.com/t5/Splunk-Search/Append-showing-result-in-new-row/m-p/167856#M47810 <P>I get this error - <CODE>Error in 'stats' command: The argument 'value(foo)' is invalid.</CODE></P> Thu, 05 Dec 2013 16:12:38 GMT https://community.splunk.com/t5/Splunk-Search/Append-showing-result-in-new-row/m-p/167856#M47810 mcamilleri 2013-12-05T16:12:38Z https://community.splunk.com/t5/Splunk-Search/Append-showing-result-in-new-row/m-p/167857#M47811 <P>Just needed to change <CODE>value</CODE> to <CODE>values</CODE>. And it's <CODE>5minutesago</CODE> instead of <CODE>5monthsago</CODE>. Thanks @yannK!</P> Thu, 05 Dec 2013 16:16:48 GMT https://community.splunk.com/t5/Splunk-Search/Append-showing-result-in-new-row/m-p/167857#M47811 mcamilleri 2013-12-05T16:16:48Z