How can I join two searches on a common field?

[alanzchan]

I'm trying to append a two tables on a common key. I am using |appendcols but the two tables are not internally joined, just placed side by side. Am I correct to use |appendcols?

[richgalloway · Accepted solution]

appendcols is rarely useful, IMO. As you've discovered, it combines events without regard for the value of any field.

Depending on the nature of your data and what you want to do with the results, you should consider the stats or join command. The former is more efficient, but can be tricky to get the right results.

If you post some sample events or queries, I may be able to make more specific suggestions.