Adding a column from a subsearch

[hatbeard]

I have this query that i've lightly changed from the winfra app, but i want to add a PID into it, that would be in the second query. I'm having trouble figuring out how to get this done.

eventtype="perfmon_windows" (Host="SERVER" ) Host="*" object="Process" counter="% Processor Time" instance="coldfusion*" AND NOT instance="coldfusions*"  | stats sparkline(avg(Value)) as Trend avg(Value) as Average, max(Value) as Peak, latest(Value) as Current, latest(_time) as "Last Updated" by instance | convert ctime("Last Updated") | sort - Current | eval Average=round(Average, 2) | eval Peak=round(Peak, 2) | eval Current=round(Current, 2)

then there's this one, which has the value of the PID

eventtype="perfmon_windows" (Host="SERVER" ) object="Process" instance="coldfusion*" AND NOT instance="coldfusions*"  counter="ID Process" |table Value

When I use a JOIN i get far too many columns back.

[kamal_jagga]

There should be 1 field common in both the queries to combine the values.

Your first query doesn't have "value" field being carried in the final results.

Example:
| inputlookup abc.csv
| table common_field host
| appendcols
[| inputlookup xyz.csv
| table common_field dest
]
| table common_field host dest

[hatbeard]

The instance field is common between them. They're similar searches, just on different objects.

[kamal_jagga]

Following should work.
Example:
Search 1
| table instance *
| appendcols
[|Search 2
| table instance PID
]
| table instance PID *