topic Re: APPEND is not UNION? in Splunk Search

APPEND is not UNION?

joy76 — Thu, 15 Mar 2012 22:18:58 GMT

Splunk version 4.3

search A : index=webserver1 type=error | table serverName message method
search B : index=webserver2 type=error | table serverName message method
search C : index=webserver1 type=error | table serverName message method | APPEND [index=webserver2 type=error] | table serverName message method

search A results is 20.
search B results is 0.
search C results is 0. Why?

I expected results is 20+0=20.

Thanks. Everyone

Re: APPEND is not UNION?

imrago — Fri, 16 Mar 2012 10:03:09 GMT

there is an error in search C, try this:

index=webserver1 type=error | APPEND [search index=webserver2 type=error] | table serverName message method

Re: APPEND is not UNION?

cpeteman — Fri, 28 Jun 2013 20:35:52 GMT

Technically two errors but you fixed them both.

Re: APPEND is not UNION?

cpeteman — Fri, 28 Jun 2013 20:39:18 GMT

There are two Problems here. The first is that in a subsearch you need to actually write out 'search' in the beginning. Also the order should be different. You first need to append them and the make it a table you can't append a table with a search. Hope this works:

search C: index=webserver1 type=error | append [search index=webserver2 type=error] | table serverName message method

Re: APPEND is not UNION?

sideview — Sat, 29 Jun 2013 04:02:41 GMT

Note it makes no sense to run search C. Instead you would run:

(index=webserver1 OR index=webserver2) type=error | table serverName message method

and this will run much faster than using append. Append should be used only as a last resort when faster simpler methods fail.

Re: APPEND is not UNION?

cpeteman — Mon, 01 Jul 2013 22:19:07 GMT

Good point.

Re: APPEND is not UNION?

cpeteman — Mon, 01 Jul 2013 22:20:59 GMT

No reason to write out more than needed

Re: APPEND is not UNION?

cpeteman — Mon, 01 Jul 2013 22:28:21 GMT

Sorry one last comment. Are the parens necessary here? I'm aware of the inherent AND but would:
index=webserver1 OR index=webserver2 type=error | table serverName message method
work the same?

Re: APPEND is not UNION?

sideview — Mon, 01 Jul 2013 23:26:21 GMT

No, they're not necessary in the language. But when there's ambiguity, once in a while people do misinterpret what the search is doing, so I like to put in the parentheses when there's ambiguity. Along the same lines as the principle of not writing the most advanced code you can - if you do that then only some as good as you or better can read it.

Re: APPEND is not UNION?

cpeteman — Tue, 02 Jul 2013 23:20:52 GMT

That makes sense. thx.

Re: APPEND is not UNION?

joy76 — Thu, 08 Aug 2013 04:27:23 GMT

Thanks for you help.

Re: APPEND is not UNION?

cpeteman — Thu, 08 Aug 2013 15:02:40 GMT

Sure thing.

Re: APPEND is not UNION?

morethanyell — Fri, 07 Sep 2018 11:56:43 GMT

should be accepted answer