Splunk附加不按预期工作？

Question

如果我理解正确， append 会将结果返回到与上一个查询相同的行。任何人都知道为什么我在结果中得到2个单独的行：1行包含 foo 号码而另一行包含 bar 号码？并且没有 DiffPercent ？

earliest=-5m@m latest=@m <my query> |stats sum(eval(MessageCount)) as foo | append [search earliest=-10m@m <same query> |stats sum(eval(MessageCount)) as bar] | append [eval DiffPercent = (bar - foo) / bar * 100]

Answer 1

在这里回答：http://answers.splunk.com/answers/113880/append-showing-result-in-new-row

earliest=-5m@m latest=@m <my query> 
|stats  sum(eval(MessageCount)) as foo 
| eval title="5minutesago"
| append [  
search earliest=-10m@m <same query> 
|stats sum(eval(MessageCount)) as bar 
| eval title="10minutesago"
] 
| stats values(foo) AS foo values(bar) AS bar 
| eval DiffPercent = (bar - foo) / bar * 100