I'm trying to append a two tables on a common key. I am using |appendcols
but the two tables are not internally joined, just placed side by side. Am I correct to use |appendcols
?
appendcols
is rarely useful, IMO. As you've discovered, it combines events without regard for the value of any field.
Depending on the nature of your data and what you want to do with the results, you should consider the stats
or join
command. The former is more efficient, but can be tricky to get the right results.
If you post some sample events or queries, I may be able to make more specific suggestions.
appendcols
is rarely useful, IMO. As you've discovered, it combines events without regard for the value of any field.
Depending on the nature of your data and what you want to do with the results, you should consider the stats
or join
command. The former is more efficient, but can be tricky to get the right results.
If you post some sample events or queries, I may be able to make more specific suggestions.