search hunk virtual index and splunk index in one search

[nekb1958]

is there a possiblity to combine a hunk (virtual) index and a normal splunk index (for example a summary index) in one search? when a try it naiv with

index="virtualindex" index="splunkindex"

i got "no result found". the single searches

index="virtualindex"

and

index="splunkindex"

give me records according to the indexes.
Is there any possiblity to combine this???

bye norbert

[nekb1958]

omg. stupid norbert! thanks!
logical thinking wasn´t my task today. taking virtualindex AND splunkindex means in SPL surely "virtualindex OR splunkindex". i am a little nervous and thats the result 🙂
Thanks, thanks, ...

[csharp_splunk · Accepted solution]

index="virtualindex" OR index="splunkindex" should work. By default, two operands are assumed to be an AND rather an OR.

[nekb1958]

omg. stupid norbert! thanks!
logical thinking wasn´t my task today. taking virtualindex AND splunkindex means in SPL surely "virtualindex OR splunkindex". i am a little nervous and thats the result 🙂
Thanks, thanks, ...

[Ledion_Bitincka]

You need to use a disjunction to search multiple indexes - virtual indexes behave exactly the same as native indexes in this respect. Here's an example search:

index=a OR index=b