union command examples
The following are examples for using the SPL2 union command.
To learn more about the union command, see How the SPL2 union command works.
1. Union events from multiple datasets
The following example merges events from the customers and orders index datasets, and the vendors_lookup dataset. You must separate the dataset names with a comma.
| union customers, orders, vendors_lookup
You can also embed the union command in the from command by using a subsearch in the FROM clause expression:
| FROM [union customers, orders, vendors_lookup] WHERE ...
2. Union events from an incoming set of search results
The following example merges events from incoming search results with an existing dataset.
| from mysecurityview | fields _time, clientip | union customers
3. Union the results of a subsearch to the results of the main search
The following example appends the current results of the main search with the tabular results of errors from the subsearch.
... | stats count() BY category1 | union [search error | stats count() BY category2]
See also
| union command usage | where command overview |
This documentation applies to the following versions of Splunk® Cloud Services: current
Download manual
Feedback submitted, thanks!