Archive

How to search multiple virtual indexes with Splunk Analytics for Hadoop?

Builder

Hello, we currently have two virtual indexes with data in them retrieving data from Hadoop Distributed File System.
We want to run one query to search over both indexes.
I hoped that:
index=abc OR index=xyz "keyword"
would work correctly but it only returns values from index=abc.
Anyone got any idea on how to search multiple indexes?

0 Karma

Splunk Employee
Splunk Employee

I just tried it without any issues.
I tried both index=xyz OR index=abc somekeyword as well as (index=abc somekey=somevalue) OR (index="xyz" somekey=somevalue)

0 Karma

Builder

Weird, I wonder why my version isn't working. thanks.

0 Karma

SplunkTrust
SplunkTrust

Hi Eric. What version of Splunk are you running?

So I saw a similar issue: https://answers.splunk.com/answers/536338/hunk-searching-two-different-virtual-indexes-using.html

I've upgraded all our Splunk instances to Splunk 6.6 and I cannot reproduce this error.

0 Karma

SplunkTrust
SplunkTrust

Does the index=xyz "keyword" returns result when run separately?

0 Karma

Builder

Yes each one returns individual results.

0 Karma