append command: Overview, syntax, and usage
The SPL2 append command appends the results of a subsearch to the current results.
The SPL2 append command appends the results of a subsearch to the current results. This command runs only over historical data and does not produce correct results if used in a real-time search.
Syntax
The required syntax is in bold.
append
[ subsearch ]
Required arguments
subsearch
Syntax: [search subsearch_criteria]
Description: A search within a primary, or outer, search. The subsearch is run first. Subsearches must be enclosed in square brackets.
Usage
The append command is a transforming command, which orders the results into a data table.
This SPL2 append command does not support the following subsearch-options, which are used with the SPL version of the append command. Instead, the default values for these subsearch options are used:
- extendtimerange: Any time range specified in the subsearch is ignored. Only the time range for the main search is used.
- maxtime: The maximum time, in seconds, to spend on the subsearch before automatically finalizing is 60 seconds.
- maxout: The maximum number of result rows to output from the subsearch is 5000.
- timeout: The maximum time, in seconds, to wait for the subsearch to fully finish is 60 seconds.
See also
append command