Splunk Enterprise

Questions about federated search subsearch?

KwonTaeHoon
Path Finder

Hello

I want to ask a question about subsearch.

When submitting a fed command without using it, an error message occurs as follows.

Before setting federated search ]

index=fw | join src_ip [ sourcetype=ips | stats count by src_ip ]

>> Result : OK

After setting federated search ]

index=fw | join src_ip [ sourcetype=ips | stats count by src_ip ]

>> Result : NG
Error : Search command can only accept one federated index.

Is there any solution?

Labels (1)
Tags (1)
0 Karma

nejmeddine
Loves-to-Learn

can i use federated search between different versions splunk ?

0 Karma
Get Updates on the Splunk Community!

New in Observability - Improvements to Custom Metrics SLOs, Log Observer Connect & ...

The latest enhancements to the Splunk observability portfolio deliver improved SLO management accuracy, better ...

Improve Data Pipelines Using Splunk Data Management

  Register Now   This Tech Talk will explore the pipeline management offerings Edge Processor and Ingest ...

3-2-1 Go! How Fast Can You Debug Microservices with Observability Cloud?

Register Join this Tech Talk to learn how unique features like Service Centric Views, Tag Spotlight, and ...