topic Re: Hunk: Searching two different virtual indexes using OR: should work? in Splunk Search

Hunk: Searching two different virtual indexes using OR: should work?

burwell — Sat, 20 May 2017 07:29:21 GMT

In regular Splunk I can easily search for

index=index1 OR index=index2 <search term> | stats count by index

Then I get results from either index.

When I setup a virtual index in Hunk 6.5.3 searching ORC files and I do a similar query I seem to only get results from one index.
Is there something inherently different in the way Hunk searches that this wouldn't work?

Re: Hunk: Searching two different virtual indexes using OR: should work?

rdagan_splunk — Sat, 20 May 2017 20:07:51 GMT

It should work in Hunk.
Can I assume that these two queries work without a problem?
index=index1 a=term | stats count by index
index=index2 a=term | stats count by index
but this one does not?
index=index1 OR index=index2 a=term | stats count by index

Re: Hunk: Searching two different virtual indexes using OR: should work?

burwell — Mon, 22 May 2017 18:06:43 GMT

Hi Raanan. Your query above is exactly what I was experimenting with.

So I did some more experiments.

If my virtual indexes points to 2 Hive databases, then the query with OR works fine. I get results from two different indexes.
If my virtual indexes point to 2 ORC files, I can only get the results for one.

I will file a support ticket. Thanks for confirming the expected results.