union command usage
union command is a generating command. Generating commands fetch information from the datasets, without any transformations.
You can use the
union command at the beginning of your search to combine two datasets or later in your search where you can combine the incoming search results with a dataset.
Specifying a dataset
You can declare, or specify, a dataset several different ways. Here are some examples:
|Type of declaration
|Specifying an existing dataset that is defined in the Metadata Catalog. The datasets in this example are indexes.
|Specifying a SPL subsearch as the dataset. Subsearches are enclosed in square brackets.
|The search results that are piped into the
union command are referred to as a fluent dataset. This type of declaration has a
union command that contains one or more subsearches.
|Using literal values that you type in as subsearches. Each subsearch is a dataset. This example shows three separate literal dataset declarations.
|Specifying a mixture of the types of declarations.
If all of the datasets that are unioned together are streamable time-series, the
union command attempts to interleave the data from all datasets into one globally sorted list of events or metrics. The list is based on the
_time field in descending order. Otherwise, the
union command returns all the rows from the first dataset, followed by all the rows from the second dataset, and so on.
When two datasets are retrieved from disk in time descending order, which is the default sort order, the
union command interleaves the results. The interleave is based on the
_time field. For example, suppose you have the following datasets:
Both datasets are descending order by
| union dataset_A, dataset_B is run, the following dataset is the result.
union command syntax details
union command examples
This documentation applies to the following versions of Splunk® Cloud Services: current