union command examples
The following are examples for using the SPL2
To learn more about the
union command, see How the union command works.
1. Union events from multiple datasets
The following example merges events from the customers and orders index datasets, and the vendors_lookup dataset. You must separate the dataset names with a comma.
| union customers, orders, vendors_lookup
You can also embed the
union command in the
from command by using a subsearch in the FROM clause expression:
| FROM [union customers, orders, vendors_lookup] WHERE ...
2. Union events from an incoming set of search results
The following example merges events from incoming search results with an existing dataset.
| from mysecurityview | fields _time, clientip | union customers
3. Union the results of a subsearch to the results of the main search
The following example appends the current results of the main search with the tabular results of errors from the subsearch.
... | stats count() BY category1 | union [search error | stats count() BY category2]
union command usage
where command overview
This documentation applies to the following versions of Splunk® Cloud Services: current