Splunk Search

Combining contents of two tables

kmattern
Builder

I have two lookup tables that have the same number of fields with the same field names in the same order. The first table has data from three days ago to yesterday. The second table has data only for today. They are updated by different searches.

My question is how can I combine them to display as one table? It shouldn't be that hard.

Tags (3)
0 Karma

Ayn
Legend
| inputlookup your_first_lookup_table | append [| inputlookup your_second_lookup_table]
Get Updates on the Splunk Community!

Extending Observability Content to Splunk Cloud

Watch Now!   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to leverage ...

More Control Over Your Monitoring Costs with Archived Metrics!

What if there was a way you could keep all the metrics data you need while saving on storage costs?This is now ...

New in Observability Cloud - Explicit Bucket Histograms

Splunk introduces native support for histograms as a metric data type within Observability Cloud with Explicit ...