Splunk version 4.3
search A : index=webserver1 type=error | table serverName message method
search B : index=webserver2 type=error | table serverName message method
search C : index=webserver1 type=error | table serverName message method | APPEND [index=webserver2 type=error] | table serverName message method
search A results is 20.
search B results is 0.
search C results is 0. Why?
I expected results is 20+0=20.
Thanks. Everyone
That makes sense. thx.
No, they're not necessary in the language. But when there's ambiguity, once in a while people do misinterpret what the search is doing, so I like to put in the parentheses when there's ambiguity. Along the same lines as the principle of not writing the most advanced code you can - if you do that then only some as good as you or better can read it.
Sorry one last comment. Are the parens necessary here? I'm aware of the inherent AND but would:
index=webserver1 OR index=webserver2 type=error | table serverName message method
work the same?
No reason to write out more than needed
Good point.
Note it makes no sense to run search C. Instead you would run:
(index=webserver1 OR index=webserver2) type=error | table serverName message method
and this will run much faster than using append. Append should be used only as a last resort when faster simpler methods fail.
There are two Problems here. The first is that in a subsearch you need to actually write out 'search' in the beginning. Also the order should be different. You first need to append them and the make it a table you can't append a table with a search. Hope this works:
search C: index=webserver1 type=error | append [search index=webserver2 type=error] | table serverName message method
should be accepted answer
Sure thing.
Thanks for you help.
there is an error in search C, try this:
index=webserver1 type=error | APPEND [search index=webserver2 type=error] | table serverName message method
Technically two errors but you fixed them both.