multisearch

Run multiple independent searches and combine (union) their results.

Syntax

| multisearch [<search1>] [<search2>] [<search3>] ...

Examples

-- Union results from multiple sources
| multisearch
    [search source=nginx | stats count by uri]
    [search source=api-gw | stats count by uri]
    [search source=redis | stats count by command]

Notes

• Each subsearch runs independently and results are concatenated.
• For joining on common fields, use join instead.

See Also

• append -- Append a single subsearch
• join -- Join on common fields