topic Re: How can I get the search work with multiple indexes in Splunk Search

How can I get the search work with multiple indexes

vl951f — Thu, 27 May 2021 23:05:56 GMT

I have the search to get max number of hours without events for feeds.

It works just for one index. It wouldn't work with more than one index. How can I get it work for multiple indexes?

Re: How can I get the search work with multiple indexes

richgalloway — Fri, 28 May 2021 00:17:20 GMT

"It wouldn't work" is not a problem description. Your query works for me (using my own index names). Well, it produces output, anyway. I can't say if it truly works since you don't say what it's supposed to do.

What results do you get and what results do you expect?

Re: How can I get the search work with multiple indexes

gcusello — Fri, 28 May 2021 06:19:38 GMT

Hi @vl951f,

are you sure that the field name is always the same in all indexes (upper and lowercase)?

If not, you have to add a command to your search:

Please, when you insert code in your comments, please use the Insert/Edit code sample Button (</>).

Ciao.

Giuseppe

Re: How can I get the search work with multiple indexes

vl951f — Fri, 28 May 2021 19:07:43 GMT

Hi,

I'm trying to get the max number of hours with no events for the indexes.

It works when I did it for one index.

index=feed1
Result:
index max(number_of_zeros)
feed1 6

index=feed2
Result:
index max(number_of_zeros)
feed2 4

But got wrong results for more than one index:

index=feed1 OR index=feed2
Result:
index max(number_of_zeros)
feed1 1
feed2 2

Re: How can I get the search work with multiple indexes

vl951f — Fri, 28 May 2021 19:10:42 GMT

I'm just counting the number of event for each hour for the index.

| bucket _time span=1h
| stats count as event_count by _time, index

It didn't use any other field names.

Re: How can I get the search work with multiple indexes

isoutamo — Fri, 28 May 2021 21:42:11 GMT

When you are calculating delta there are different events which it's use based on one index or several. For that reason the delta between those events are different. You could get better result if you change in stats by to index, _time instead of _time, index (but it's not works 100% of time still, if will be broken when index changes from one to another). I afraid that you need to reformulate this query to get correct answer for several indexes.

You can check the events by commenting out the last stats statement and try to figure out the correct answer.

r. Ismo

Re: How can I get the search work with multiple indexes

vl951f — Fri, 28 May 2021 21:51:13 GMT

It works by changing "by _time,index" to "by index,_time"!

Thank you so much