Dynamic table - Create three tables in one

[renanprado96]

Hi, I have three reports, each with a different index.
And I wanted to join them in the same table.
Example:

I have tables A, B and C.
I wanted to have only one table with four fields: time, K1, K2 and K3.
But, each table is a search for a different index.

Grateful!

[sideview]

If your base searches are simple event searches with no pipes, you won't need any append/appendcols or anything that actually joins separate searches. Here is the sort of thing that would achieve this in one search.

(index=A <searchTerms for A> ) OR ( index=B <searchTerms for B> ) OR (index=C <searchTerms for C> )| timechart span=7d avg(K1) avg(K2) avg(K3)

If one or more of your searches actually contain other search commands, and those commands cannot be safely run (or be tweaked to safely run) on the other two searches output rows, that's the sort of use case where you actually do need append/appendcols/join etc.

[gyslainlatsa · Accepted solution]

hi,
try using appendcols (reassures you that the query contains a field that is common to the three indexes)

   index=index1 | your search1
        |appendcols [search index=index2 | your search2] 
        |appendcols [search index=index3 | your search3 ]

see this example with appendcols

index=_internal |stats count as K1 by _time 
|appendcols [search index=_audit |stats count as K2 by _time] 
|appendcols [search index="_introspection" |stats count as K3 by _time ]

that is the result

[gyslainlatsa]

Thanks, don't forget to vote

[somesoni2]

Depending upon your current queries for each table, there may be different options, so Please provide your current queries. Possible options for you would be to use appendcols OR join OR append-stats combination OR (recommended way if possible) merge all three query in one base search (others involves sub searches).