index=* activatesessionIdsForREST() : partnerId=11111111111 ActivateOfferRequestVO |dedup sessionIds|stats count(sessionIds) as SessionCount by partnerId append [search index=* activatesessionIdsForREST() : partnerId=22222222222 ActivateOfferRequestVO |dedup sessionIds|stats count(sessionIds) as SessionCount by partnerId]
Above is my query
I am looking for a table like
PartnerId SessionCount
11111111111 10
22222222222 20
When I run the first query, I get the result separately
index=* activatesessionIdsForREST() : partnerId=11111111111 ActivateOfferRequestVO |dedup sessionIds|stats count(sessionIds) as SessionCount by partnerId append
I get
PartnerId SessionCount
11111111111 10
but when I append the second query, I dont get results. Appreciate any suggestion
hi,
If you want to use the append command
, use the pipe |
before like this:
index= activatesessionIdsForREST() : partnerId=11111111111 ActivateOfferRequestVO |dedup sessionIds |stats count(sessionIds) as SessionCount by partnerId
|append [search index=activatesessionIdsForREST() : partnerId=22222222222 ActivateOfferRequestVO
|dedup sessionIds|stats count(sessionIds) as SessionCount by partnerId]
hi,
If you want to use the append command
, use the pipe |
before like this:
index= activatesessionIdsForREST() : partnerId=11111111111 ActivateOfferRequestVO |dedup sessionIds |stats count(sessionIds) as SessionCount by partnerId
|append [search index=activatesessionIdsForREST() : partnerId=22222222222 ActivateOfferRequestVO
|dedup sessionIds|stats count(sessionIds) as SessionCount by partnerId]
thanks, don't forget to vote.