Is there a way to get 2 nonstream Searches to run in parallel in the same SPL?

[robertlynch2020]

Hi - Is there a way to get 2 nonstream Searches to run in parallel in the same SPL?

I am using "appendcols", but I think one is waiting for the other to finish.

I can't use multisearch as I don't have stream commands.
The issue is displaying the license used by Splunk and I want to run 2 SPL in parallel. However, it's very slow to run if I run 2 in sequence. Thanks in advance for any help

index=_internal 
    [ `set_local_host`] source=*license_usage.log* type="Usage" 
| eval h=if(len(h)=0 OR isnull(h),"(SQUASHED)",h) 
| eval s=if(len(s)=0 OR isnull(s),"(SQUASHED)",s) 
| eval idx=if(len(idx)=0 OR isnull(idx),"(UNKNOWN)",idx) 
| bin _time span=1d 
| stats sum(b) as b by _time, pool, s, st, h, idx 
| search pool = "*" 
| search idx != "mlc_log_drop" 
| timechart span=1d sum(b) AS Live_Data fixedrange=false 
| fields - _timediff 
| foreach * 
    [ eval <<FIELD>>=round('<<FIELD>>'/1024/1024/1024, 3)] 
| appendcols 
    [ search index=_internal 
        [ `set_local_host`] source=*license_usage.log* type="Usage" 
    | eval h=if(len(h)=0 OR isnull(h),"(SQUASHED)",h) 
    | eval s=if(len(s)=0 OR isnull(s),"(SQUASHED)",s) 
    | eval idx=if(len(idx)=0 OR isnull(idx),"(UNKNOWN)",idx) 
    | bin _time span=1d 
    | stats sum(b) as b by _time, pool, s, st, h, idx 
    | search pool = "*" 
    | search idx = "mlc_log_drop" 
    | timechart span=1d sum(b) AS Log_Drop_Data fixedrange=false 
    | fields - _timediff 
    | foreach * 
        [ eval <<FIELD>>=round('<<FIELD>>'/1024/1024/1024, 3)]] 

[PickleRick · Accepted solution]

You're asking a wrong question.

Your both searches start with the same base search so either you should be able to do all in one go or your searches produce differently aggregated results so it doesn't make sense to combine them with appendcols.

[robertlynch2020]

HI

I agree that is correct and this was an example of 2 SPLs I had, but I had other issues else where the SPLs were different.

The UNION command was able to help me out in this case.

Thanks

Robert