How to align events returned by two separate searches in a table?

[vinit_masaun]

Reference post 

https://community.splunk.com/t5/Splunk-Search/How-to-align-events-returned-by-two-separate-searches-... 

Hi Team, 

I have this similar use from above post case but cannot get the provided solution to work.  Following is my query:

index=_audit action=alert_fired | lookup splunkalerts "Alert Name" as ss_name OUTPUT "CMDB Application Name" AS Application
| search Application="Test"
| stats count(triggered_alerts) as triggered_alerts by Application ss_name severity | rename ss_name as "Alert Name" severity as "Severity"
| appendcols
[ | rest /servicesNS/-/-/saved/searches timeout=120
| lookup splunkalerts "Alert Name" AS title OUTPUT "CMDB Application Name" AS Application "Pipeline Alert" "PROD?"
| search Application="Test"
| rename eai:acl.owner as owner title as "Alert Name"
| fields owner "Alert Name" Application,"Pipeline Alert","PROD?",alert.track,disabled,search,action.email.to,cron_schedule]
| table Application,"Alert Name",Severity,triggered_alerts,"PROD?","Pipeline Alert",alert.track,disabled,search,action.email.to,cron_schedule

The issue I am having with the above query is that the triggered_alerts count returned from the outer query is not aligned with the search field value returned from the sub search after the appendcols.

[kamlesh_vaghela · Accepted solution]

@vinit_masaun 

If you have the same number of results in both searches then you will get perfect alignment else you can try the below search. In this search, I have assumed that the Alert Name is the Key field for event alignment.

index=_audit action=alert_fired 
| lookup splunkalerts "Alert Name" as ss_name OUTPUT "CMDB Application Name" AS Application 
| search Application="Test" 
| stats count(triggered_alerts) as triggered_alerts by Application ss_name severity 
| rename ss_name as "Alert Name" severity as "Severity" 
| append 
    [| rest /servicesNS/-/-/saved/searches timeout=120 
    | lookup splunkalerts "Alert Name" AS title OUTPUT "CMDB Application Name" AS Application "Pipeline Alert" "PROD?" 
    | search Application="Test" 
    | rename eai:acl.owner as owner title as "Alert Name" 
    | fields owner "Alert Name" Application,"Pipeline Alert","PROD?",alert.track,disabled,search,action.email.to,cron_schedule] 
| table Application,"Alert Name",Severity,triggered_alerts,"PROD?","Pipeline Alert",alert.track,disabled,search,action.email.to,cron_schedule
| stats values(*) as * by "Alert Name"

I hope this will help you.

Thanks
KV
If any of my replies help you to solve the problem Or gain knowledge, an upvote would be appreciated.

[vinit_masaun]

Thank you, KV.  That resolved the alignment issue for this query.  I have a follow up question on the rest query part.  Is the data I am trying to pull via the rest query available in an internal index?  The reason is that the rest query takes a long time to return results and I am trying to build a dashboard that will be used by multiple executives.  I am looking for ways to improve the performance and avoid the intermittent timeout issue.