Splunk Search

Why does the multisearch command only return results for the second search, but both searches produce results when run separately?

luisterra
Explorer

Hi,

I'm on 6.1.1 and I need to search two different indexes, so I thought the multisearch command would be up for the job.

The first search is:

index=a  sourcetype=b f1!="" f2!="stuff" f2!="stuff" f2!="sti=stuff"
| rex max_match=0 field=f3 "\/\/(?P<nf>[a-zA-Z0-9\-\.]+)"
| regex fqdn="(^|\s)\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}"
| search NOT [|inputlookup file1 | fields xf4 | rename f4 as f4]
| fields f1 f2 f3 f4 f5 f6 f7
| fields - _raw
| mvexpand f5
| search f5!=*.jpg f5!=*.jpeg f5!=*.gif f5!=*.txt f5!=*.png
| mvexpand nf
| regex nf="(^|\s)\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}"
| regex f5="\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}"
| search nf!="10.0.0.0/8" nf!="172.16.0.0/12" nf!="127.0.0.1" nf!="192.168.0.0/16"
| eval check=1

Second search:

index=c sourcetype=d earliest=-2d f9=0 f10=0  
| regex b_f="^\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}"
| fields b_f
| eval check=2

With multisearch:

|multisearch
[search index=a  sourcetype=b f1!="" f2!="stuff" f2!="stuff" f2!="sti=stuff"
| rex max_match=0 field=f3 "\/\/(?P<nf>[a-zA-Z0-9\-\.]+)"
| regex fqdn="(^|\s)\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}"
| search NOT [|inputlookup file1 | fields xf4 | rename f4 as f4]
| fields f1 f2 f3 f4 f5 f6 f7
| fields - _raw
| mvexpand f5
| search f5!=*.jpg f5!=*.jpeg f5!=*.gif f5!=*.txt f5!=*.png
| mvexpand nf
| regex nf="(^|\s)\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}"
| regex f5="\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}"
| search nf!="10.0.0.0/8" nf!="172.16.0.0/12" nf!="127.0.0.1" nf!="192.168.0.0/16"
| eval check=1]

[search index=c sourcetype=d earliest=-2d f9=0 f10=0  
| regex b_f="^\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}"
| fields b_f
| eval check=2]

Both searches return events I run them on their own, but with multisearch, no joy.
Am I missing something?
Why do I only get results from the second search?

thanks in advance for any pointers!

0 Karma
1 Solution

luisterra
Explorer

I think I got it.

I thought the issue was with my multisearch, but in fact it is to do with the dedup that follows it!

|multisearch
[search1]
[search2]
| dedup b_f

View solution in original post

0 Karma

luisterra
Explorer

I think I got it.

I thought the issue was with my multisearch, but in fact it is to do with the dedup that follows it!

|multisearch
[search1]
[search2]
| dedup b_f
0 Karma
Get Updates on the Splunk Community!

Splunk Answers Content Calendar, June Edition

Get ready for this week’s post dedicated to Splunk Dashboards! We're celebrating the power of community by ...

What You Read The Most: Splunk Lantern’s Most Popular Articles!

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...

See your relevant APM services, dashboards, and alerts in one place with the updated ...

As a Splunk Observability user, you have a lot of data you have to manage, prioritize, and troubleshoot on a ...