Append Generic Saved Search Result

[sanjay_shrestha]

Hi,

I created generic saved search and it is running fine individually as below

|savedsearch PausedTime_SS index_name=one_index

However, when I called them twice and append their results

|savedsearch PausedTime_SS index_name=one_index
    |append [|savedsearch PausedTime_SS index_name=other_index]

I am getting following:

Error in 'SearchParser': Found circular dependency when expanding savedsearch=PausedTime_SS

Is it possible to append results from generic saved searches?

Thanks,

Sanjay

[ksarpol]

There is no circular dependency condition so the fact that the error is thrown is a bug as far as I can tell. I don't have time and patience to open a support case for it.

This is my workaround. I'm not passing any parameters my saved search is pure streaming commands so I can't be sure it will work in other cases.

| union 
    [| savedsearch search1 | <stuff> ] 
    [| savedsearch search1 | <different stuff> ]

The "set union", "multisearch" and "multireport" commands may work.

[afret2007]

There should be no pipe in front of your saved search inside the brackets.
"| savedsearch PausedTime_SS index_name=one_index
| append [ savedsearch PausedTime_SS index_name=other_index ]"

[mateuszk]

Dear Splunk Team

Could we expect to get some answer for this issue?
This problem stops us from having more elaborate queries.
Is there maybe some simple and nice workaround for this issue?

Regards

[vishalsharma198]

Hi I am also facing a similar issue, did you get a work around?

[kmartine]

I have a similar issue. Did you ever get a response? If not, how did you work around this?