Hello, we currently have two virtual indexes with data in them retrieving data from Hadoop Distributed File System.
We want to run one query to search over both indexes.
I hoped that:
index=abc OR index=xyz "keyword"
would work correctly but it only returns values from index=abc.
Anyone got any idea on how to search multiple indexes?
Hi Eric. What version of Splunk are you running?
So I saw a similar issue: https://answers.splunk.com/answers/536338/hunk-searching-two-different-virtual-indexes-using.html
I've upgraded all our Splunk instances to Splunk 6.6 and I cannot reproduce this error.