Appends the result of the subpipeline applied to the current result set to results.
appendpipe [run_in_preview=<bool>] [<subpipeline>]
- Syntax: run_in_preview=T|F
- Description: Specify whether or not to run the command in preview mode. Defaults to T.
Example 1: Append subtotals for each action across all users.
index=_audit | stats count by action user | appendpipe [stats sum(count) as count by action | eval user = "ALL USERS"] | sort action
Have questions? Visit Splunk Answers and see what questions and answers the Splunk community has using the appendpipe command.