topic Re: How to combine two searches with streaming commands? in Splunk Search

How to combine two searches with streaming commands?

mgutschelhofer — Tue, 05 Jul 2022 05:19:45 GMT

I want to combine two search results, whereby I'm only interested in the last x/y events from each subquery. Something like this:

This leads to following error: ...Error in 'multisearch' command: Multisearch subsearches might only contain purely streaming operations (subsearch 1 contains a non-streaming command)....

Any idea how this can be achieved?

Re: How to combine two searches with streaming commands?

PickleRick — Tue, 05 Jul 2022 05:25:24 GMT

Now that's interesting because all comands are streaming. Maybe Splunk tried to optimize the search and came up with some non-streaming equivalent and shot itself in the foot. Anyway. If your subsearches are small and quick you can use append.

Re: How to combine two searches with streaming commands?

mgutschelhofer — Tue, 05 Jul 2022 05:34:19 GMT

I tried with append:

But for some reasons I get two events where testtype=="endp-system".

Expected: I get two events: testtype="endp-health" and the other with testtype="endp-system"

Re: How to combine two searches with streaming commands?

PickleRick — Tue, 05 Jul 2022 05:57:49 GMT

Strange. Works for me.

Re: How to combine two searches with streaming commands?

mgutschelhofer — Tue, 05 Jul 2022 06:08:20 GMT

Hi,

after putting the result in a table, the result is OK 🙂

For completeness, this now shows correct results:

Many Thanks, you saved my day.

Cheers, Martin

Re: How to combine two searches with streaming commands?

jolenescott — Fri, 17 May 2024 14:41:57 GMT

Hello Splunk Community,

To combine two search results where you are interested in the last x/y events from each subquery, you can utilize streaming commands effectively by piping the output of the first search into the second one. For instance, you can use command-line tools like grep, awk, or sed to filter and merge the results. If you're dealing with more complex data, consider using a programming language like Python with libraries such as pandas for better manipulation and merging of search results. Finally, to enhance your streaming and searching experience, I recommend you install the Spotify Web Mod PC. This mod can help streamline your music searches and organize your playlists efficiently, providing a seamless integration into your overall workflow.

Best Regards!!