How can you display results from 2 contrasting text searches in 1 table with no designated key pairs?

[Adam_Berliner_M]

Afternoon!

Hope this isn't too basic of a question here, but I've been striking out on finding a similar search to use as an example.
I'm basically trying to parse 2 separate results out of the same log entry and display them in a single table.

Search 1:

host=ServerNumber1 sourcetype=log adventure NOT "Buck" | rename uniqueid as item1 | dedup item1 | table item1

Search 2:

host=ServerNumber1 sourcetype=log "Buck" | rename uniqueid as item2 | dedup item2 | table item2

I'm trying to figure out how to get item1 and item2 in to the same table in separate columns.
Any help would be appreciated!

[sundareshr · Accepted solution]

How do you want the final display? Item1 & Item2 as different columns in your table. See if this gives you what your are looking for

host=ServerNumber1 sourcetype=log adventure NOT "Buck" | rename uniqueid as item1 | stats count by item1 | fields - count | appendcols [ host=ServerNumber1 sourcetype=log "Buck" | rename uniqueid as item2 | stats count by item2 | fields - count]

[rafasalo]

What should I do if i want to reduce item2 from item1 and after that see the results as a table?

[Adam_Berliner_M]

Thanks for the response! Really appreciate it!
That got me what I needed...

For anyone else who happens apon this string, I had to make two changes to get it to work
1) had to add search after the appendcols [
2) had to move the | fields - count to OUTSIDE of the ].

So the final serach looked like:

host=ServerNumber1 sourcetype=log adventure NOT "Buck" | rename uniqueid as item1 | stats count by item1 | fields - count | appendcols [search host=ServerNumber1 sourcetype=log "Buck" | rename uniqueid as item2 | stats count by item2] | fields - count