This page explains how to use the union operator in APL.
union
operator in APL allows you to combine the results of two or more queries into a single output. The operator is useful when you need to analyze or compare data from different datasets or tables in a unified manner. By using union
, you can merge multiple sets of records, keeping all data from the source tables without applying any aggregation or filtering.
The union
operator is particularly helpful in scenarios like log analysis, tracing OpenTelemetry events, or correlating security logs across multiple sources. You can use it to perform comprehensive investigations by bringing together information from different datasets into one query.
union
operator works, consider these datasets:
Server requests
_time | status | method | trace_id |
---|---|---|---|
12:10 | 200 | GET | 1 |
12:15 | 200 | POST | 2 |
12:20 | 503 | POST | 3 |
12:25 | 200 | POST | 4 |
_time | trace_id | message |
---|---|---|
12:12 | 1 | foo |
12:21 | 3 | bar |
13:35 | 27 | baz |
Server requests
and Application logs
would result in a new dataset with all the rows from both DatasetA
and DatasetB
.
A union of requests and logs would produce the following result set:
_time | status | method | trace_id | message |
---|---|---|---|---|
12:10 | 200 | GET | 1 | |
12:12 | 1 | foo | ||
12:15 | 200 | POST | 2 | |
12:20 | 503 | POST | 3 | |
12:21 | 3 | bar | ||
12:25 | 200 | POST | 4 | |
13:35 | 27 | baz |
Splunk SPL users
append
command works similarly to the union
operator in APL. Both operators are used to combine multiple datasets. However, while append
in Splunk typically adds one dataset to the end of another, APL’s union
merges datasets while preserving all records.ANSI SQL users
UNION
operator performs a similar function to the APL union
operator. Both are used to combine the results of two or more queries. However, SQL’s UNION
removes duplicates by default, whereas APL’s union
keeps all rows unless you use union with=kind=unique
.T1, T2, T3, ...
: Tables or query results you want to combine into a single output.withsource
: Optional, adds a field to the output where each value specifies the source dataset of the row. Specify the name of this additional field in FieldName
.union
operator returns all rows from the specified tables or queries. If fields overlap, they are merged. Non-overlapping fields are retained in their original form.
union
operator to combine HTTP logs from different sources, such as web servers and security systems, to analyze trends or detect anomalies.Query_time | id | status | uri | method | geo.city | geo.country | req_duration_ms |
---|---|---|---|---|---|---|---|
2024-10-17 12:34:56 | user123 | 500 | /api/login | GET | London | UK | 345 |
2024-10-17 12:35:10 | user456 | 500 | /api/update-profile | POST | Berlin | Germany | 123 |
github-push-event
and github-pull-request-event
without any transformation or filtering.
method
is GET
.
content_type
and actor
.
github-actions[bot]
, and displays key event details such as time
, repository
, commits
, head
, id
.
content_type
and commits
field in the datasets sample-http-logs
and github-push-event
before combining the datasets.
method
is GET
.
type
field.
content_type
contains the letter a
and city
is seattle
.
geo.city
and repo
entries in the combined dataset.
github*
and counts the number of events in each.
union
operator, ensure that the fields being merged have compatible data types.project
or project-away
to include or exclude specific fields. This can improve performance and the clarity of your results, especially when you only need a subset of the available data.