Feedback:

appendcols

Use the appendcols operator to define a subsearch to append the output columns to the results of the main search, or conditionally replace the column values with the subsearch output values.

Syntax

| appendcols [override=true|false] [<subsearch>]

[override=true|false]

Specify true to replace the main query result field values with the subsearch result field values in the search results table (if the same fields appear in results for both queries).

When the override option is used, the results table has the following combination:

  • the fields from the main query, which are not present in the subsearch results.

  • the fields which are present in both main and subsearch results, and subsearch results are used.

  • the fields which are present only in the subsearch results.

The implicit default is false. The subsearch results are appended to the results of the main query. If the main and subsearch share common fields, and the result set of the subsearch is larger than the main results, the difference of the subsearch results is added to the main results.
[<subsearch>]

Specify an AQL subsearch in square brackets.

Usage

A main query comprises the piped syntax that precedes the appendcols piped operator.

A subsearch is the query following the appendcols piped operator.

The search results combine the two queries. If the results have any of the same fields, you can use the override option to replace the main query result field values with the subsearch result field values.

Examples

Example 1: Replace field values using subsearch results.

The following AQL query uses the override option to replace field values returned in the main query (in this case, the default search) with the values returned by the where operator specified in the subsearch:

Copy 
| appendcols override=true [| where action='Allowed' and src_port=1122]

Example 2: Append new columns from a subsearch calculation.

The following AQL query does not use the override option. The subsearch adds a new field created by the calc function:

Copy 
| limit 5 | appendcols override  [| limit 1 | calc new_field="test"]