Add field from the returns of another query

[yk010123]

I am trying to produce the following output :

app_name	request_id	time	workload at the time(requests per second)
App1	123	1000	?
App2	1234	1000	?

I have two queries that return :

1. A table with the requests taking the most time

app_name	request_id	time
app1	1	1000

2. Numeric value that returns the requests per second for a given app

app_name	requests per second
app1	10

How can I join the results from two different queries to produce the final table above?

Thank you!

[ITWhisperer]

From your simplistic description, all I can suggest is:

search 1
| join app_name [search 2]

If this doesn't work, you will need to provide more detail of what you are actually doing

[yk010123]

This is what I tried but that does not return any result: 

index=myIndex method!=GET process="end" | join app_name [search index=myIndex  method!=GET process="start" | timechart count by app_name | timechart per_second(*) ]
| table _time app_name request_id

[ITWhisperer]

Try something like this

index=myIndex method!=GET process="end" 
| bin _time span=1s
| join _time app_name [search index=myIndex  method!=GET process="start" 
  | timechart span=1s count by app_name 
  | timechart span=1s per_second(*) as *
  | untable _time app_name per_second ]
| table _time app_name request_id per_second

[yk010123]

Thank you for the suggestion. I tried that but it returned : 

[subsearch]: The specified span would result in too many (>50000) rows.

And no results. It seems that the only way it works is if I run it in a smaller time range (the individual queries work fine under a longer range) 

Perhaps we could group the requests per second over a longer timeframe (for example, report of the last n minutes) is that possible? 

Also, in some instances, the requests per second field is returning 0 which does not make any sense. Is there some rounding going on?

Also, if possible, could you please break down the query so that I understand your reasoning? 

Thank you again!