topic Re: help on basic search with 2 index in Splunk Search

help on basic search with 2 index

jip31 — Tue, 18 Feb 2020 11:04:41 GMT

HIhi

why I have no resulys even if I merge 2 index even if I have results when I execute one or the other?
(index=ai-pe-* sourcetype="Perfmon:Mem OR index=ai-wmi-* sourcetype="WMI:Mem")
| fields host Value TotalPhysicalMemory
| eval FreeMemory = round(Value, 2). " MB"
| eval TotalMemory = round((TotalPhysicalMemory / 1024 / 1024), 2). " MB"

Re: help on basic search with 2 index

nickhills — Tue, 18 Feb 2020 11:09:07 GMT

Your query currently gets interpreted as this:
(I'm also guessing there were *s in the index names - use the code formatter tool 101010 to avoid the html renderer removing them)

index=ai-pe-* AND (sourcetype="Perfmon:Mem OR index=ai-wmi-*) AND sourcetype="WMI:Mem"

Instead you want:

(index=ai-pe-* AND sourcetype="Perfmon:Mem) OR (index=ai-wmi-* AND sourcetype="WMI:Mem")

You can leave the ANDs out - I just added them for clairty

Re: help on basic search with 2 index

jip31 — Tue, 18 Feb 2020 11:47:54 GMT

you are right, thanks