Why not try Splunk SA- Splice ? Does a great job https://splunkbase.splunk.com/app/2637/ ... View more

append is not a valid keyword for join . What this line | join yumclientip append [ search ...] ...will do is take the results from the first part of the search, and then try to join that set of records to the set of records returned by the second search, joining them based on the values in the fields named yumclientip and append on each side of the search. Since the only fields on the right side of the search are totalcount , yumclientip and yumdate , there will never be a match found. Delete the word "append" from the join clause and see what happens. I'm still not sure that you have the correct code for what you want, but at least you will get some results. ... View more