I'm trying to combine fields in multiple search result in one output table as overall result, for example:
Search 1 result
Search 2 result
Date,open ,close,incident ,type1,result
Hope question is clear
There should be a common field in main & sub search to map the results correctly,
if you want to just append the columns use the above answer ----- appendcols, append commands should work for that.
if you want to map the results between main and sub search based on a specific field ----- join command should work for you.
main search | fields date,open,close,incidentnum | join incidentnum [search subsearch | fields incident,type1,result,incidentnum] | stats c by date,open,close,incidentnum,incident,type1,result