topic Append Generic Saved Search Result in Reporting

Append Generic Saved Search Result

sanjay_shrestha — Wed, 02 Apr 2014 14:52:10 GMT

Hi,

I created generic saved search and it is running fine individually as below

|savedsearch PausedTime_SS index_name=one_index

However, when I called them twice and append their results

|savedsearch PausedTime_SS index_name=one_index
    |append [|savedsearch PausedTime_SS index_name=other_index]

I am getting following:

Error in 'SearchParser': Found circular dependency when expanding savedsearch=PausedTime_SS

Is it possible to append results from generic saved searches?

Thanks,

Sanjay

Re: Append Generic Saved Search Result

kmartine — Thu, 09 Oct 2014 18:00:32 GMT

I have a similar issue. Did you ever get a response? If not, how did you work around this?

Re: Append Generic Saved Search Result

vishalsharma198 — Fri, 02 Sep 2016 07:11:23 GMT

Hi I am also facing a similar issue, did you get a work around?

Re: Append Generic Saved Search Result

mateuszk — Tue, 28 Mar 2017 13:36:28 GMT

Dear Splunk Team

Could we expect to get some answer for this issue?
This problem stops us from having more elaborate queries.
Is there maybe some simple and nice workaround for this issue?

Regards

Re: Append Generic Saved Search Result

afret2007 — Tue, 29 Sep 2020 19:31:33 GMT

There should be no pipe in front of your saved search inside the brackets.
"| savedsearch PausedTime_SS index_name=one_index
| append [ savedsearch PausedTime_SS index_name=other_index ]"

Re: Append Generic Saved Search Result

ksarpol — Fri, 20 Jul 2018 18:18:57 GMT

There is no circular dependency condition so the fact that the error is thrown is a bug as far as I can tell. I don't have time and patience to open a support case for it.

This is my workaround. I'm not passing any parameters my saved search is pure streaming commands so I can't be sure it will work in other cases.

| union 
    [| savedsearch search1 | <stuff> ] 
    [| savedsearch search1 | <different stuff> ]

The "set union", "multisearch" and "multireport" commands may work.