https://community.splunk.com/t5/Splunk-Enterprise/Questions-about-federated-search-subsearch/m-p/632519#M15523 <P><SPAN>Hello</SPAN><BR /><BR /><SPAN>I want to ask a question about subsearch.</SPAN><BR /><BR /><SPAN>When submitting a fed command without using it, an error message occurs as follows.</SPAN></P> <P><SPAN>Before setting federated search ]</SPAN><BR /><BR /><SPAN>index=fw | join src_ip [ sourcetype=ips | stats count by src_ip ]</SPAN><BR /><BR /><SPAN>&gt;&gt; Result : OK</SPAN><BR /><BR /><SPAN>After setting federated search ]</SPAN><BR /><BR /><SPAN>index=fw | join src_ip [ sourcetype=ips | stats count by src_ip ]</SPAN><BR /><BR /><SPAN>&gt;&gt; Result : NG</SPAN><BR /><SPAN>Error : Search command can only accept one federated index.</SPAN><BR /><BR /><SPAN>Is there any solution?</SPAN><!-- /data/user/0/com.samsung.android.app.notes/files/clipdata/clipdata_bodytext_230228_172354_323.sdocx --></P> Tue, 28 Feb 2023 18:51:34 GMT KwonTaeHoon 2023-02-28T18:51:34Z https://community.splunk.com/t5/Splunk-Enterprise/Questions-about-federated-search-subsearch/m-p/632519#M15523 <P><SPAN>Hello</SPAN><BR /><BR /><SPAN>I want to ask a question about subsearch.</SPAN><BR /><BR /><SPAN>When submitting a fed command without using it, an error message occurs as follows.</SPAN></P> <P><SPAN>Before setting federated search ]</SPAN><BR /><BR /><SPAN>index=fw | join src_ip [ sourcetype=ips | stats count by src_ip ]</SPAN><BR /><BR /><SPAN>&gt;&gt; Result : OK</SPAN><BR /><BR /><SPAN>After setting federated search ]</SPAN><BR /><BR /><SPAN>index=fw | join src_ip [ sourcetype=ips | stats count by src_ip ]</SPAN><BR /><BR /><SPAN>&gt;&gt; Result : NG</SPAN><BR /><SPAN>Error : Search command can only accept one federated index.</SPAN><BR /><BR /><SPAN>Is there any solution?</SPAN><!-- /data/user/0/com.samsung.android.app.notes/files/clipdata/clipdata_bodytext_230228_172354_323.sdocx --></P> Tue, 28 Feb 2023 18:51:34 GMT https://community.splunk.com/t5/Splunk-Enterprise/Questions-about-federated-search-subsearch/m-p/632519#M15523 KwonTaeHoon 2023-02-28T18:51:34Z https://community.splunk.com/t5/Splunk-Enterprise/Questions-about-federated-search-subsearch/m-p/642304#M16248 <P>can i use federated search between different versions splunk ?</P> Thu, 04 May 2023 14:30:23 GMT https://community.splunk.com/t5/Splunk-Enterprise/Questions-about-federated-search-subsearch/m-p/642304#M16248 nejmeddine 2023-05-04T14:30:23Z