My code:
My basic search| rex "maingroupNo>(?.+)\(?.+)\(?.+)\"
| convert timeformat="%H:%M:%S" dur2sec(TimeInSec)
| stats count first(TimeInSec) AS endTime last(TimeInSec) AS startTime by UserID DATE maingroup subgroup
| append [search
| My basic search | rex "maingroupNo>(?.+)\(?.+)\(?.+)\"
| stats list(secId) as secId_new by UserID DATE maingroup subgroup ]
The result looks like as following:
The append command was adding a new table following the result of first search, but I wanna add the second search as a new column of the first search, any ideas?
Thanks in advance!
Oh, solved my problem 🙂
Used appendcols instead of append.