Appending tables in searches

[SplnkUse]

Hello

Is it possible to append two searches?

I have a search that ends in:

| table A B C

And I want to append to the above some values under A, B, C that I calculate.

Can you tell me please the syntax for that?

Thanks!

[ldongradi_splun]

| append [...] will append the inner search results to the outer search. For example: index=foo | stats count | append [index=bar | stats count]

| appendpipe [...] will prolongate the outer search with the inner search modifications, and append the results instead of replacing them. For example: ... | appendpipe [ | stats count as extracount]

| eventstats ... will add extra columns to an existing table with a treatment like a stats, without any further transformation. For example | eventstats avg(bytes) by server 

| streamstats ... will add extra columns to an existing table, but each calculated result depend on the previous results. For example:  | streamstats count as rank

For your needs, append may not be what you're looking for. The 2 searches are independant.

[SplnkUse]

@ITWhisperer  thanks but I cannot make it work, it seems it does not keep aliases within the brackets and run the whole thing as one, instead of each separately and then join, is there any solution?

[ITWhisperer]

What is the actual search that you are using?

[SplnkUse]

@ITWhisperer  thanks, I am trying to combine searches in the following format. I know it may be difficult to picture the below but I cannot post more exact data.

I think the problem is that  the:

 eval a="aaa"

is contained in two different searches and is set to different values.

Any idea?

index=a aa!="" | fields aa
| stats count by aa
| eval a="aa"
| eval Timestamp=strftime(now(),"%d/%m/%Y %H:%M:00")
| table a b c

| append [
search
index=aa or index=bbb
| eval
| stats
| eval a="aaa"
| eval Timestamp=strftime(now(),"%d/%m/%Y %H:%M:00")
| table a bb cc
]
| append [
search
index=aa or index=bbb
| eval
| stats
| eval a="aaaa"
| eval Timestamp=strftime(now(),"%d/%m/%Y %H:%M:00")
| table a bbb ccc

[PickleRick]

The syntax looks ok, but each of your subsearches returns different set of fields. If you want to have three columns as output, you have to return the same set of fields from each of subsearches. Do a rename at the end of your subsearches so that the returned fields are named consistently.

[ITWhisperer]

This is the right sort of syntax - what is the issue you are facing with doing it this way?

[ITWhisperer]

search
| table A B C
| append
  [search
   | table A B C]