union command: Examples

The following are examples for using the SPL2 union command. To learn more about the union command, see How the SPL2 union command works.

1. Merging of events from multiple datasets

The following example merges events from the %customers; and %orders; index datasets, and the %vendors_lookup; dataset. You must separate the dataset names with a comma. 

| union customers, orders, vendors_lookup

You can also embed the union command in the from command by using a subsearch in the FROM clause expression: 

| FROM [union customers, orders, vendors_lookup] WHERE ...

2. Merging events from an incoming set of search results

The following example merges events from incoming search results with an existing dataset. 

| from mysecurityview | fields _time, clientip | union customers

3. Appending the results of a subsearch to the results of the main search

The following example appends the current results of the main search with the tabular results of errors from the subsearch. 

... | stats count() BY category1 | union [search error | stats count() BY category2]