appendtable
Use the appendtable operator to perform a subsearch and append the results from both the searches together.
See Subsearch documentation for more information on how you can create more powerful queries that dynamically adapt according to the results of the embedded query.
Syntax
|appendtable [eventlog | fields src_port, dest_port]
[subsearch]
|
A secondary search where you specify the source of the events that you want to append. The subsearch must be enclosed in square brackets ( |
Usage
The appendtable is a transformation operator. You can use it to view the results of a subsearch together with the existing results.
Examples
Example 1: Append computed field results to main query results.
|appendtable_test | fields src_port, dest_port, action | appendtable [appendtable_test | calc x = 123 ] | sort xExample 2: Append subsearch results with a different field set.
| fields src, dest | appendtable [| fields sourcetype]Example 3: Append filtered subsearch results to main results.
| fields src, dest | appendtable [| where src != ‘test’]Example 4: Append calculation results from subsearch.
| fields src, dest | appendtable [| calc x=’test’]