Splunk Search

Combining contents of two tables


I have two lookup tables that have the same number of fields with the same field names in the same order. The first table has data from three days ago to yesterday. The second table has data only for today. They are updated by different searches.

My question is how can I combine them to display as one table? It shouldn't be that hard.

Tags (3)
0 Karma

Re: Combining contents of two tables

| inputlookup your_first_lookup_table | append [| inputlookup your_second_lookup_table]