https://community.splunk.com/t5/Splunk-Search/union-results-in-a-table/m-p/35570#M7816 <P>I am trying to display in one table a difference from a performance log to a specific service from 2 diffrent times (for example : how much time a service (avg and count) took today vs yesterday) </P> <P>I tried using : stats/fields/table but each time my final result is a table where the 1st avg and the 2nd avg are not in the same row</P> <PRE><CODE>index=asindex source=Prod sourcetype=performance vo!=null lastLap&gt;10000 earliest=-3d@d latest=-2d@d | chart avg(lastLap) as avg_time count by vo | eval key="1st" | fields vo avg_time count key | append [ search index=asindex source=Prod sourcetype=performance vo!=null lastLap&gt;10000 earliest=-2d@d latest=-1d@d | chart avg(lastLap) as avg_time2 count as count2 by vo | eval key="2nd" | fields vo avg_time2 count2 ] </CODE></PRE> <P>vo - is the field who display the service name.</P> <P>how can i union the avg_time2 and avg_time1 to be in the same row for a certain "vo"</P> Mon, 28 Sep 2020 14:34:34 GMT avishayh 2020-09-28T14:34:34Z https://community.splunk.com/t5/Splunk-Search/union-results-in-a-table/m-p/35570#M7816 <P>I am trying to display in one table a difference from a performance log to a specific service from 2 diffrent times (for example : how much time a service (avg and count) took today vs yesterday) </P> <P>I tried using : stats/fields/table but each time my final result is a table where the 1st avg and the 2nd avg are not in the same row</P> <PRE><CODE>index=asindex source=Prod sourcetype=performance vo!=null lastLap&gt;10000 earliest=-3d@d latest=-2d@d | chart avg(lastLap) as avg_time count by vo | eval key="1st" | fields vo avg_time count key | append [ search index=asindex source=Prod sourcetype=performance vo!=null lastLap&gt;10000 earliest=-2d@d latest=-1d@d | chart avg(lastLap) as avg_time2 count as count2 by vo | eval key="2nd" | fields vo avg_time2 count2 ] </CODE></PRE> <P>vo - is the field who display the service name.</P> <P>how can i union the avg_time2 and avg_time1 to be in the same row for a certain "vo"</P> Mon, 28 Sep 2020 14:34:34 GMT https://community.splunk.com/t5/Splunk-Search/union-results-in-a-table/m-p/35570#M7816 avishayh 2020-09-28T14:34:34Z https://community.splunk.com/t5/Splunk-Search/union-results-in-a-table/m-p/35571#M7817 <P>You could use join rather than append.</P> <P>index=asindex source=Prod sourcetype=performance vo!=null lastLap&gt;10000 earliest=-3d@d latest=-2d@d | chart avg(lastLap) as avg_time count by vo | eval key="1st" | fields vo avg_time count key | join host [ search index=asindex source=Prod sourcetype=performance vo!=null lastLap&gt;10000 earliest=-2d@d latest=-1d@d | chart avg(lastLap) as avg_time2 count as count2 by vo | eval key="2nd" | fields vo avg_time2 count2 ]</P> Mon, 28 Sep 2020 14:34:37 GMT https://community.splunk.com/t5/Splunk-Search/union-results-in-a-table/m-p/35571#M7817 linu1988 2020-09-28T14:34:37Z https://community.splunk.com/t5/Splunk-Search/union-results-in-a-table/m-p/35572#M7818 <P>I think you are making this far more complicated than you need to. If I understand you correctly, a simple <CODE>stats</CODE> (or <CODE>chart</CODE> or <CODE>timechart</CODE>) might do the trick. And avoid <CODE>join</CODE> - really.</P> <PRE><CODE>index=asindex source=Prod sourcetype=performance vo!=null lastLap&gt;10000 earliest=-3d@d latest=-1d@d | timechart span=1d count avg(lastLap) by vo </CODE></PRE> <P>another option might be to use <CODE>chart</CODE> instead of <CODE>timechart</CODE>;</P> <P><CODE>... | chart count avg(lastLap) over vo by date_mday</CODE></P> <P>Hope this helps,</P> <P>K</P> Thu, 15 Aug 2013 11:18:13 GMT https://community.splunk.com/t5/Splunk-Search/union-results-in-a-table/m-p/35572#M7818 kristian_kolb 2013-08-15T11:18:13Z