Splunk Search
Highlighted

Combining contents of two tables

Builder

I have two lookup tables that have the same number of fields with the same field names in the same order. The first table has data from three days ago to yesterday. The second table has data only for today. They are updated by different searches.

My question is how can I combine them to display as one table? It shouldn't be that hard.

Tags (3)
0 Karma
Highlighted

Re: Combining contents of two tables

Legend
| inputlookup your_first_lookup_table | append [| inputlookup your_second_lookup_table]