Creating a table from diff source

[marinewcreater]

HI Team,

I would like to create a table in a dashboard from two difference results.

Eg: Blue stack results and Green stack results has to display on a same table like below.

Green /t Blue

Service Call_count Service Call_count

[marinewcreater]

index = avb source = "blue | stats count by Service, Call_count
index = avb source = "Green | stats count by Service, Call_count

Is it possible to display both results in same table, as Header Green / Blue and next line header as Service / Call_count

[dindu]

Hi,
Please check whether the below snippet is what you are looking for.

  index=avb source="blue" 
 |eval Blue_Green="Blue"
 |stats count as "Service_Call Count" by Service, Call_count ,Blue_Green
 |append [ search index=avb source="Green"
 |eval Blue_Green="Green"
 |stats count as "Service_Call Count" by Service, Call_count,Blue_Green]
  |fields - Service,Call_count

[dindu · Accepted solution]

H,

Do you have any specific requirements?
If not, please check on the join and append options.

https://docs.splunk.com/Documentation/SplunkCloud/8.0.0/SearchReference/Join
https://docs.splunk.com/Documentation/Splunk/8.0.0/SearchReference/Append
https://docs.splunk.com/Documentation/SplunkInvestigate/Current/SearchReference/JoinCommandUsage

Please try and let us know!!