SPLUNK Query to combine two coloums as per the search string

[bvsuman]

Am using two Queries using appendcols to get the data . Sample data is as follows

Classification | Name | Basket1 |Basket2 | Basket1+2
Fruit | Mango | aa |xx |aaxx
Fruit | Apple |bb |yy |bbyy
Fruit | Banana |cc |zz | cczz
Fruit | Pineapple |dd |uu |dduu

In basket 1 sequence of fruits is Mango, Apple, Bananna, Pineapple whereas the sequence of Basket2 is Bananna( zz),Mango(uu), Apple(yy),pineapple(xx)

As per my requirement the result will be like below

Classification |Name| Basket1 | Basket2 | Basket1+2
Fruit |Mango|aa |uu |aauu
Fruit | Apple |bb|yy| bbyy
Fruit|Banana |cc |zz |cczz
Fruit|Pineapple| dd| xx|ddxx

[bvsuman]

So please help me

[bvsuman]

sourcetype="st-offline-orders" NonContinuableError earliest=-48h@h latest=-24h@h |rex field=_raw "NonContinuableError:(?<NCE>.?)|DN" |search NCE NOT (:CON-* OR :CUST OR loginError) | eval Hour=strftime(_time, "%H") | chart count over NCE by Day | addtotals | sort 0 -Total |lookup local=true "FileName" NON_CONTINUABLE_ERROR as NCE OUTPUT CLASSIFICATION as Classification | where Classification="FRUIT" |table Classification NCE Total * | addcoltotals | rename "Total" as "Basket1" |appendcols [search sourcetype="st-online-orders" earliest=-48h@h latest=-24h@h NonContinuableError |rex field=_raw "NonContinuableError:(?<NCE>.?)|DN" |search NCE NOT (:CON-* OR :CUST OR loginError) | eval Hour=strftime(_time, "%H") | chart count over NCE by Day| addtotals | sort 0 -Total |lookup local=true "FileName1" NON_CONTINUABLE_ERROR as NCE OUTPUT CLASSIFICATION as Classification | where Classification="FRUIT" |table Classification NCE Total * | addcoltotals |rename "Total" as "Basket2"]| fields - NULL | eval Basket1+2=Basket1 + Basket2

[kamlesh_vaghela]

@bvsuman
Can you please share your both sample searches ??

[bvsuman]

sourcetype="st-offline-orders" NonContinuableError earliest=-48h@h latest=-24h@h |rex field=_raw "NonContinuableError:(?.?)|DN" |search NCE NOT (:CON- OR :CUST* OR loginError) | eval Hour=strftime(_time, "%H") | chart count over NCE by Day | addtotals | sort 0 -Total |lookup local=true "FileName" NON_CONTINUABLE_ERROR as NCE OUTPUT CLASSIFICATION as Classification | where Classification="FRUIT" |table Classification NCE Total | addcoltotals | rename "Total" as "Basket1" |appendcols [search sourcetype="st-online-orders" earliest=-48h@h latest=-24h@h NonContinuableError |rex field=_raw "NonContinuableError:(?.?)|DN" |search NCE NOT (:CON- OR :CUST OR loginError) | eval Hour=strftime(_time, "%H") | chart count over NCE by Day| addtotals | sort 0 -Total |lookup local=true "FileName1" NON_CONTINUABLE_ERROR as NCE OUTPUT CLASSIFICATION as Classification | where Classification="FRUIT" |table Classification NCE Total * | addcoltotals |rename "Total" as "Basket2"]| fields - NULL | eval Basket1+2=Basket1 + Basket2