appendpipe

The appendpipe command appends the results of a subpipeline to the search results. Unlike a subsearch, the subpipeline is not executed first; it runs only when the search reaches the appendpipe command.

The command aligns columns that have the same field names and types. For columns that exist in only the main search or subpipeline, NULL values are inserted into the missing fields for the respective rows.

Syntax

The appendpipe command has the following syntax:

appendpipe [<subpipeline>]

Parameters

The appendpipe command supports the following parameters.

Example 1: Append rows from a total count to existing search results

This example appends rows from total by gender to sum by gender, state, merging columns that have the same field name and type:

source=accounts
| stats sum(age) as part by gender, state
| sort -part
| head 5
| appendpipe [ stats sum(part) as total by gender ]

The query returns the following results:

Example 2: Append rows with merged column names

This example appends rows from count by gender to sum by gender, state:

source=accounts
| stats sum(age) as total by gender, state
| sort -total
| head 5
| appendpipe [ stats sum(total) as total by gender ]

The query returns the following results:

Limitations

The appendpipe command has the following limitations:

• Schema compatibility: When fields with the same name exist in both the main search and the subpipeline but have incompatible types, the query fails with an error. To avoid type conflicts, ensure that fields with the same name share the same data type. Alternatively, use different field names. You can rename the conflicting fields using eval or select non-conflicting columns using fields.