How to join or append searches in Splunk, with rest and subsearches?

[Zarack]

I tried to do it this way, but the results don't match.
How can i show the result of the first search and then the second one in columns of the correct order?


| rest /services/data/transforms/lookups
| table eai:acl.app eai:appName filename title fields_list updated id *
| where type="file"
| map maxsearches=1000 search="| inputlookup $filename$ | stats count | where count = 0 | eval lookup_vazia=$filename$"
|append
[ search index=_internal sourcetype=lookup_editor_rest_handler "Lookup edited successfully"
| stats count by _time user namespace lookup_file
| rename lookup_file as "lookup_editada"
]

[bowesmana]

To collapse those after the append, you just need to use 

| stats list(*) as * by common_field

but you need to have that common field. In your first search, the lookup is named lookup_vazia, but in the append it's lookup_editada.

If you make the field name the same in both cases and rename the first count to something else, so it will not conflict with the second count and do the stats above.

Note that list(*) will only produce 100 rows max per lookup - if you use values, it will sort each multi-value field, so the time, user and namespace fields will not correlate. If you need to handle that, I suggest you combine those 3 fields into a single field in the append and then user values(*) so you will get all values.