Merging two data sources

[keishamtcs]

Hi..

Need some help in merging two search result.

i have one source with below result as such -

CommonIndex host Max
WinUnix appdcos 23.10
WinUnix hpmail 91.80

Another search result with output as such -

CommonIndex host Max
WinUnix ADDS 20.25
WinUnix BCMP 75.16

How can i reproduce the results like below in a single table. I have tried join,append but output is not correct.

CommonIndex host Max
WinUnix appdcos 23.10
WinUnix hpmail 91.80
WinUnix ADDS 20.25
WinUnix BCMP 75.16

[richgalloway]

It would help to see your two searches, but the general way to do it is to merge the two queries. You shouldn't need to use append or join.

(index=index1 sourcetype=st1) OR (index=index1 sourcetype=st2) | ... | table ComminIndex host Max

[thambisetty · Accepted solution]

Hi,
try something like below,

index=a | table CommonIndex host Max | append [|search index=b | table CommonIndex host Max]

if fields are common in two indexes. you can try something like below,

index=a OR index=b | table CommonIndex host Max