topic Re: can multiple indexes be searched for different fields? in Splunk Dev

can multiple indexes be searched for different fields?

agentguerry — Mon, 02 Mar 2020 13:51:35 GMT

Can splunk search for different indexes that contain different fields, and present that data out in readable format?

I am trying to use one search that looks in index A, for specific fields, then another search for index B, looking for different fields than are contained in index A.

This is in an attempt to give out a daily report that can give us a single email showing us different tables on a single email of:

cpu percentage
drive full percentage
status of an application (running/stopped)
etc.

Or is there perhaps a way that splunk can merge separate reports into one, and email it out in the message body?

I will continue looking, but any help is appreciated. thanks.

Re: can multiple indexes be searched for different fields?

manjunathmeti — Mon, 02 Mar 2020 14:08:30 GMT

You can search both the indexes with OR.

(index=indexA fieldA1=<> fieldA2=<>) OR (index=indexB fieldB1=<> fieldB2=<>) | table index, fieldA1, fieldA2, fieldB1, fieldB2

Re: can multiple indexes be searched for different fields?

gaurav_maniar — Mon, 02 Mar 2020 14:22:08 GMT

Hi,

this can be done in multiple ways.
- append - https://docs.splunk.com/Documentation/Splunk/8.0.2/SearchReference/Append
it appends the results from the subsearch to the mail search as events

appendcols - https://docs.splunk.com/Documentation/Splunk/8.0.2/SearchReference/Appendcols it will add the columns from the subsearch to the main search. The first subsearch result is merged with the first main result, the second subsearch result is merged with the second main result, and so on, without any relation.

you will get the better idea by going through the examples given on the reference sites.

accept & up-vote the answer if it helps

Re: can multiple indexes be searched for different fields?

agentguerry — Mon, 02 Mar 2020 14:40:26 GMT

thanks i will look into these more. i do find that i can export a dashboard as pdf to email. that may work for us for our needs.
I believe that option will attach the pdf, but not plant the dashboard into the email body.

Re: can multiple indexes be searched for different fields?

gaurav_maniar — Thu, 05 Mar 2020 07:52:04 GMT

accept the answer that helped to close the question.