I know that there is a splunk documentation page for the append command, but I have not found any splunk documentation for the appendcols command. I wonder if there are other less-documented append functions like appendrow. My question is about the differences and unique strengths of each append* command compared to the others. Specifically, when would you use appendpipe instead of append and what does appendcol do different than append, etc.?
Here is the basic usage of each command per my understanding.
append - to append the search result of one search with another (new search with/without same number/name of fields) search.
Usually to append final result of two searches using different method to arrive to the result (which can't be merged into one search)
index=A | stats count by sourcetype | append [search index=B | stats count by sourcetype]
**sourcetype count** SourceTypeA1 10 SourceTypeA2 70 SourceTypeB1 77 SourceTypeB2 70 SourceTypeB3 34
appendpipe - to append the search results of post process (subpipeline) of the current resultset to current result set.
Typically to add summary of the current result set.
index=B | stats count by sourcetype | appendpipe [|stats sum(count) as count | eval sourcetype="All SourceTypes"]
**sourcetype count** SourceTypeB1 77 SourceTypeB2 70 SourceTypeB3 34 All SourceTypes 181
appendcols - to append the fields of one search result with other search result. Fields are added row-wise, 1st row of first search will be merged with 1st row of 2nd search.
Value of common fields between results will be overwritten by 2nd search result values.
Typically to show comparitive analysis of two search results in same table/chart.
index=A | timechart span=1d count as CountA| appendcols [search index=B | timechart span=1d count as CountB]
_time CountA** CountB** 7/3/14 12:00:00.000 AM 867 0 7/4/14 12:00:00.000 AM 518 867 7/5/14 12:00:00.000 AM 471 518 7/6/14 12:00:00.000 AM 514 471 7/7/14 12:00:00.000 AM 908 514 7/8/14 12:00:00.000 AM 920 908
Do you know how to use the results, CountA and CountB to make some calculation? I want to know the %
Thank you in advance.