union command: Examples

The following are examples for using the SPL2 union command. To learn more about the union command, see How the SPL2 union command works.

1. Union events from multiple datasets

The following example merges events from the customers and orders index datasets, and the vendors_lookup dataset. You must separate the dataset names with a comma. 

| union customers, orders, vendors_lookup

You can also embed the union command in the from command by using a subsearch in the FROM clause expression: 

| FROM [union customers, orders, vendors_lookup] WHERE ...

2. Union events from an incoming set of search results

The following example merges events from incoming search results with an existing dataset. 

| from mysecurityview | fields _time, clientip | union customers

3. Union the results of a subsearch to the results of the main search

The following example appends the current results of the main search with the tabular results of errors from the subsearch. 

... | stats count() BY category1 | union [search error | stats count() BY category2]