Appendcols Command in Splunk

Understanding splunk appendcols command with an example

appencols command in splunk
appencols command in splunk

Hey Everyone are you stuck on how to get the results from two different index or same index in a same statistical table well no need to search more this can be achieved using appendcols command in splunk, let’s just dive into the topic.

Appends the fields of the subsearch results with the input search results. The first subsearch result is merged with the first main result, the second subsearch result is merged with the second main result, and so on.


appendcols [override= <bool> | <subsearch-options>...] <subsearch>

Required arguments:

subsearch – A secondary search added to the main search.

Optional arguments:


Syntax: override=<bool>

Default: override=false


Syntax: maxtime=<int> | maxout=<int> | timeout=<int>

Subsearch options


Syntax: maxtime=<int>


Syntax: maxout=<int>


Syntax: timeout=<int>


The appendcols command must be placed in the search string after transforming commands such as stats, chart, and timechart. The appendcols command cannot be used before the conversion command because it must be added to an existing tabular result set, such as the result generated by the transforming command.

Example for using appendcols command in splunk:

| stats count(Profit) as "Region wise Profit" by Region 
| appendcols 
    [ search source="Superstore.csv" 
    | stats count by Quantity 
    | fields - count ]
appendcols command in splunk

Explanation: The only difference between the append and appendcols is that in append we are appending the appended search query after the first query result table while in the appendcols we are actually appending the column and the appended search query result is shown in the column.

Also look for Append Command in Splunk

If you are still facing issue regarding appendcols command in splunk Feel free to Ask Doubts in the Comment Box Below and Don’t Forget to Follow us on social platforms, happy Splunking >😉

What do you think?

Leave a Reply

Your email address will not be published. Required fields are marked *

GIPHY App Key not set. Please check settings

types of splunk commands

Types of Splunk Commands

addinfo command in splunk

Addinfo Command in Splunk