https://community.splunk.com/t5/Splunk-Search/Error-While-using-quot-append-quot-command/m-p/98821#M25479 <P>Yes, try using fields to see if that corrects your issue. Then, you can upgrade to 4.3.4 at your convenience.</P> Tue, 23 Oct 2012 14:53:39 GMT sowings 2012-10-23T14:53:39Z https://community.splunk.com/t5/Splunk-Search/Error-While-using-quot-append-quot-command/m-p/98816#M25474 <P>Hi,<BR /> I am getting the following error which using "append" command :</P> <P>Encountered an error while reading file <CODE>'C:\Program Files\Splunk\var\run\splunk\dispatchtmp\subsearch_1350988212.241_1350988213.1\prereport_0.csv.gz</CODE>' </P> <P>When I am traversing to this directory I can see no data after<BR /> <CODE>'C:\Program Files\Splunk\var\run\splunk\dispatchtmp</CODE>'</P> <P>"<CODE>dispatchtmp</CODE>" directory has nothing in it.</P> <P>Please suggest me how to solve this !!</P> <P>Thanks in Advance</P> Tue, 23 Oct 2012 10:45:05 GMT https://community.splunk.com/t5/Splunk-Search/Error-While-using-quot-append-quot-command/m-p/98816#M25474 abhayneilam 2012-10-23T10:45:05Z https://community.splunk.com/t5/Splunk-Search/Error-While-using-quot-append-quot-command/m-p/98817#M25475 <P>Are you running 4.3.3? Is the subsearch you're using with append a <CODE>| rest</CODE> call? If so, you may have hit a known bug in 4.3.3. Upgrading to 4.3.4 will be necessary for that particular issue. Otherwise, can you give us some more information?</P> Tue, 23 Oct 2012 13:34:49 GMT https://community.splunk.com/t5/Splunk-Search/Error-While-using-quot-append-quot-command/m-p/98817#M25475 sowings 2012-10-23T13:34:49Z https://community.splunk.com/t5/Splunk-Search/Error-While-using-quot-append-quot-command/m-p/98818#M25476 <P>yaa , I am running 4.3.3 version.<BR /> Moreover, I am trying to append the results of two searches. Please find the snipet:</P> <P>index="xyz" | firstsearch | append [ search index="xyz" | secondsearch ] </P> <P>Please suggest me how to solve this append error,</P> Tue, 23 Oct 2012 14:29:36 GMT https://community.splunk.com/t5/Splunk-Search/Error-While-using-quot-append-quot-command/m-p/98818#M25476 abhayneilam 2012-10-23T14:29:36Z https://community.splunk.com/t5/Splunk-Search/Error-While-using-quot-append-quot-command/m-p/98819#M25477 <P>The release notes for 4.3.4 are <A href="http://docs.splunk.com/Documentation/Splunk/latest/ReleaseNotes/4.3.4" target="_blank">here</A>. They suggest that you're seeing bug SPL-52862. If you're unable to upgrade at this time, you can work around the issue by using <CODE>| fields &lt;fields_you_want&gt;</CODE> at the end of your subsearch. The list of fields should be those which are referenced by the calling (outer) search.</P> Mon, 28 Sep 2020 12:40:30 GMT https://community.splunk.com/t5/Splunk-Search/Error-While-using-quot-append-quot-command/m-p/98819#M25477 sowings 2020-09-28T12:40:30Z https://community.splunk.com/t5/Splunk-Search/Error-While-using-quot-append-quot-command/m-p/98820#M25478 <P>In my search I am using "table" command in "inner" as well as "outer" search both, should I use "fields" command instead of "table" every where ? </P> <P>Please suggest !!</P> Tue, 23 Oct 2012 14:47:17 GMT https://community.splunk.com/t5/Splunk-Search/Error-While-using-quot-append-quot-command/m-p/98820#M25478 abhayneilam 2012-10-23T14:47:17Z https://community.splunk.com/t5/Splunk-Search/Error-While-using-quot-append-quot-command/m-p/98821#M25479 <P>Yes, try using fields to see if that corrects your issue. Then, you can upgrade to 4.3.4 at your convenience.</P> Tue, 23 Oct 2012 14:53:39 GMT https://community.splunk.com/t5/Splunk-Search/Error-While-using-quot-append-quot-command/m-p/98821#M25479 sowings 2012-10-23T14:53:39Z https://community.splunk.com/t5/Splunk-Search/Error-While-using-quot-append-quot-command/m-p/98822#M25480 <P>Thanks a lot !! .. <span class="lia-unicode-emoji" title=":slightly_smiling_face:">🙂</span></P> Tue, 23 Oct 2012 15:04:53 GMT https://community.splunk.com/t5/Splunk-Search/Error-While-using-quot-append-quot-command/m-p/98822#M25480 abhayneilam 2012-10-23T15:04:53Z