Splunk Search

Combining contents of two tables

kmattern
Builder

I have two lookup tables that have the same number of fields with the same field names in the same order. The first table has data from three days ago to yesterday. The second table has data only for today. They are updated by different searches.

My question is how can I combine them to display as one table? It shouldn't be that hard.

Tags (3)
0 Karma

Ayn
Legend
| inputlookup your_first_lookup_table | append [| inputlookup your_second_lookup_table]
Get Updates on the Splunk Community!

Accelerating Observability as Code with the Splunk AI Assistant

We’ve seen in previous posts what Observability as Code (OaC) is and how it’s now essential for managing ...

Integrating Splunk Search API and Quarto to Create Reproducible Investigation ...

 Splunk is More Than Just the Web Console For Digital Forensics and Incident Response (DFIR) practitioners, ...

Congratulations to the 2025-2026 SplunkTrust!

Hello, Splunk Community! We are beyond thrilled to announce our newest group of SplunkTrust members!  The ...