How can I get the results of merging?

[flzhang132]

There are two result sets , How can I get the results of merging? and how does command (join) use？

[adonio · Accepted solution]

hello there,

assuming the field names for "project" and "yyyymm" are the same in both data sets, you can use stats instead of join
in your case, try this:

 .... your search ... "find results set 1" OR "find results set 2" ...
| stats values(fee) as fee values(vm_count) as vm_vount by project yyyymm

here is an example search to run anywhere:

| makeresults count=1 
| eval result_set_1 = "201808,cas,100;201808,at,120;201808,srm,2019"
| makemv delim=";" result_set_1
| mvexpand result_set_1
| rex field=result_set_1 "(?<yyyymm>\d{6})\,(?<project>[^,]+)\,(?<fee>\d+)"
| append
[ | makeresults count=1 
  | eval result_set_2 = "201808,cas,1;201808,at,2;201808,srm,10;201808,commonservice,1000"
  | makemv delim=";" result_set_2
  | mvexpand result_set_2 
  | rex field=result_set_2 "(?<yyyymm>\d{6})\,(?<project>[^,]+)\,(?<vm_count>\d+)" ]
| rename COMMENT as "the above generates data, below is your solution"
| stats values(fee) as fee values(vm_count) as vm_vount by project yyyymm

screenshot:

hope it helps