topic combinig two search commands in Splunk Search

combinig two search commands

vjtechie67 — Sat, 28 May 2016 05:29:50 GMT

I have 2 indexers which are having the same columns
Index1:
Name DOB Age
A 5/1/1990 25
B 7/1/2010 6

Index2:

Name DOB Age
C 5/1/2000 15
D 7/1/2003 13

I need to combine both and provide output as below. I will use this to create graphs.

Output:

Name DOB Age
A 5/1/1990 25
B 7/1/2010 6
C 5/1/2000 15
D 7/1/2003 13

Please help me. Can i use append command?

Re: combinig two search commands

javiergn — Sat, 28 May 2016 17:30:17 GMT

Simply do:

index=index1 OR index=index2
| table Name, DOB, Age

Re: combinig two search commands

woodcock — Sat, 28 May 2016 21:17:24 GMT

Like this:

index=index1 OR index=index2
| table Name DOB Age
| sort 0 Name

Re: combinig two search commands

jplumsdaine22 — Mon, 30 May 2016 11:37:19 GMT

Or if you want to make it complicated try this

[ search [| tstats count WHERE index=2 OR index=1 by index | fields index] | search index=* | stats count by index | fields index ] | table Name DOB Age | sort 0 Name