Append showing result in new row

[mcamilleri]

If I understood correctly append returns the result in the same row as the previous query. Anyone knows why I get 2 separate rows in my results: 1 row with the foo number and another with the bar number? And no DiffPercent?

earliest=-5m@m latest=@m <my query> |stats sum(eval(MessageCount)) as foo | append [search earliest=-10m@m latest=-5m@m <same query> |stats sum(eval(MessageCount)) as bar] | append [eval DiffPercent = (bar - foo) / bar * 100]

[yannK · Accepted solution]

Yes this is what append does, append row of results after the existing ones.

If you want to add columns, you may want to look at appendcols (but they may not be aligns)
or the join function (using a common field for the join)

Or simply use the append, adding an extra stats or timechart after to reformat.

earliest=-5m@m latest=@m <my query>
|stats sum(eval(MessageCount)) as foo
| eval title="5monthsago"
| append [
search earliest=-10m@m <same query>
|stats sum(eval(MessageCount)) as bar
| eval title="10monthsago"
]
| stats values(foo) AS foo values(bar) AS bar
| eval DiffPercent = (bar - foo) / bar * 100


[edit value to values]

[mcamilleri]

Just needed to change value to values. And it's 5minutesago instead of 5monthsago. Thanks @yannK!

[mcamilleri]

I get this error - Error in 'stats' command: The argument 'value(foo)' is invalid.