topic Re: append command deletes values from search in Splunk Search

append command deletes values from search

net1993 — Wed, 23 Jan 2019 22:28:38 GMT

Hi
using append to add result to search , values dissapears from my main search and drives me crazy.
The result is per search basis, meaning 1 time execute -> Null values, 2nd run -> ok - 3rd Null...
100% problem is from append.
Total non-sense and more than 7 hours analyzing.

Re: append command deletes values from search

Vijeta — Thu, 24 Jan 2019 00:30:18 GMT

There is a limit on number of events returned from sub-search, could be because of that.

Re: append command deletes values from search

net1993 — Tue, 29 Sep 2020 22:56:53 GMT

earliest=-10m latest=now index=_internal source=metrics.log fwdType!="uf" |head 2
|append [|search earliest=-10m latest=now index=_internal source=metrics.log fwdType="uf" |head 1 ]
|table hostname ,version
not possible to be issue as only 1 row.
Plus the missing data is most of time from the first search ,though sometime from both are missing.

Re: append command deletes values from search

ashmaind — Tue, 29 Jan 2019 07:33:58 GMT

Can you also try join/ appendcols and other commands.

Re: append command deletes values from search

net1993 — Tue, 29 Jan 2019 07:38:11 GMT

the same behaviour is with union

Re: append command deletes values from search

net1993 — Tue, 29 Jan 2019 07:38:29 GMT

so far is defect - splunk