Splunk Search

APPEND is not UNION?

joy76
Path Finder

Splunk version 4.3

search A : index=webserver1 type=error | table serverName message method
search B : index=webserver2 type=error | table serverName message method
search C : index=webserver1 type=error | table serverName message method | APPEND [index=webserver2 type=error] | table serverName message method

search A results is 20.
search B results is 0.
search C results is 0. Why?

I expected results is 20+0=20.

Thanks. Everyone

Tags (1)

cpeteman
Contributor

That makes sense. thx.

0 Karma

sideview
SplunkTrust
SplunkTrust

No, they're not necessary in the language. But when there's ambiguity, once in a while people do misinterpret what the search is doing, so I like to put in the parentheses when there's ambiguity. Along the same lines as the principle of not writing the most advanced code you can - if you do that then only some as good as you or better can read it.

cpeteman
Contributor

Sorry one last comment. Are the parens necessary here? I'm aware of the inherent AND but would:
index=webserver1 OR index=webserver2 type=error | table serverName message method
work the same?

0 Karma

cpeteman
Contributor

No reason to write out more than needed

0 Karma

cpeteman
Contributor

Good point.

0 Karma

sideview
SplunkTrust
SplunkTrust

Note it makes no sense to run search C. Instead you would run:

(index=webserver1 OR index=webserver2) type=error | table serverName message method

and this will run much faster than using append. Append should be used only as a last resort when faster simpler methods fail.

cpeteman
Contributor

There are two Problems here. The first is that in a subsearch you need to actually write out 'search' in the beginning. Also the order should be different. You first need to append them and the make it a table you can't append a table with a search. Hope this works:

search C: index=webserver1 type=error | append [search index=webserver2 type=error] | table serverName message method

morethanyell
Builder

should be accepted answer

0 Karma

cpeteman
Contributor

Sure thing.

0 Karma

joy76
Path Finder

Thanks for you help.

imrago
Contributor

there is an error in search C, try this:

index=webserver1 type=error | APPEND [search index=webserver2 type=error] | table serverName message method

0 Karma

cpeteman
Contributor

Technically two errors but you fixed them both.

Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...