topic Re: Keep a search from excluding results in Splunk Search

Keep a search from excluding results

pepper_seattle — Fri, 19 Jun 2015 16:30:15 GMT

I have a search which pulls from two different sourcetypes on the same index. In this search I specifically call out '| search <field>=blah', however only one of the sourcetypes contains that field so the search effectively excludes all data from the other sourcetype.

As I have to keep my search setup like so 'index=blah sourcetype=1 OR sourcetype=2 |...| stats count by sourcetype' I cannot simply append them together like I'd hoped. Additionally, searching for my field parameter in that setup does the same exclusion of data, ex: index=blah sourcetype=1 field="blah" OR sourcetype=2 | ...| stats count by sourcetype'.

My question being, is there a way to run this query with my specific field search that won't exclude the data from the second sourcetype?

Re: Keep a search from excluding results

woodcock — Fri, 19 Jun 2015 16:35:03 GMT

If I understand you correctly, like this (using parentheses to ensure proper logic):

index=blah ((sourcetype=1 field="blah") OR (sourcetype=2)) | ...| stats count by sourcetype'

Re: Keep a search from excluding results

acharlieh — Fri, 19 Jun 2015 16:37:12 GMT

There are a few options. Parenthesis is one option... e.g.

index=blah ( (sourcetype=1 field="blah") OR sourcetype=2 ) | ... | stats count by sourcetype

Another option may be multisearch

| multisearch [search index=blah sourcetype=1 field="blah"] [search index=blah sourcetype=2] | ... | stats count by sourcetype

(multisearch is cooler when you have different streaming commands to apply to each subsearch.)

Re: Keep a search from excluding results

pepper_seattle — Fri, 19 Jun 2015 16:42:13 GMT

Thanks to both of you!