Hi,
I'm querying a datamodel X and I need to append results with same fields names from datamodel xx using. I'm trying with tstats command but it's not working in ES app.
example search:
| tstats append=t `summariesonly` count from datamodel=X where earliest=-7d by dest severity
| tstats summariesonly=t append=t count from datamodel=XX where by dest severity
This will only show results of 1st tstats command and 2nd tstats results are not appended.
Is there any thing wrong here? is there any other way to achieve this?
↧