`union`

Description

The union command concatenates the results from two or more datasets into one dataset. This allows users to combine results from multiple queries into one seamless dataset. One dataset can be a result set piped into the union command and then concatenated with another dataset.

How `union` differs from `join`

union combines result sets by appending rows from one dataset to another. It does not merge or compare columns from multiple documents.
join matches and combines columns from two tables based on a condition, creating rows that contain data from both tables.

Syntax

The required syntax for union :

<query> | union <query>

Usage

Consider the following documents:

Logs for Team 58942

{ "id": "111", "name": "John" , "team.id": "58942" }
{ "id": "222", "name": "Emily", "team.id": "58942" }
{ "id": "333", "name": "Alice", "team.id": "58942" }

Logs for Team 98361

{ "userid": "111", "timestamp": "2022-01-01T12:00:00Z", "team.id": "98361" }
{ "userid": "111", "timestamp": "2022-01-01T12:30:00Z", "team.id": "98361" }
{ "userid": "222", "timestamp": "2022-01-01T13:00:00Z", "team.id": "98361" }
{ "userid": "222", "timestamp": "2022-01-01T13:00:00Z", "team.id": "98361" }
{ "userid": "222", "timestamp": "2022-01-01T13:00:00Z", "team.id": "98361" }

You want to concatenate the datasets, combining the logs for Team X and logs for Team Y into one dataset:

source logs(teamId=58942) | union logs(teamId=98361)

This will result in the following documents:

{ "id": "111", "name": "John" , "team.id": "58942" }
{ "id": "222", "name": "Emily", "team.id": "58942" }
{ "id": "333", "name": "Alice", "team.id": "58942" }
{ "userid": "111", "timestamp": "2022-01-01T12:00:00Z", "team.id": "98361" }
{ "userid": "111", "timestamp": "2022-01-01T12:30:00Z", "team.id": "98361" }
{ "userid": "222", "timestamp": "2022-01-01T13:00:00Z", "team.id": "98361" }
{ "userid": "222", "timestamp": "2022-01-01T13:00:00Z", "team.id": "98361" }
{ "userid": "222", "timestamp": "2022-01-01T13:00:00Z", "team.id": "98361" }

In this query:

source logs(teamId=58942): Retrieves all documents for Team 58942
union logs (teamID=98361): Appends the Team 98361 dataset to the Team 58942 dataset

The output combines rows from both datasets.

Best practices

Use union when you need to append rows from one dataset to another.
To process large datasets, consider using filter limiting rows from each dataset before using union to optimize performance.

Limitations

Users are limited to a maximum of 10 union commands per query for Frequent Search data. There is no limit on archived data."

top

Next wildfind / wildtext

union