APPEND is not UNION?

[joy76]

Splunk version 4.3

search A : index=webserver1 type=error | table serverName message method
search B : index=webserver2 type=error | table serverName message method
search C : index=webserver1 type=error | table serverName message method | APPEND [index=webserver2 type=error] | table serverName message method

search A results is 20.
search B results is 0.
search C results is 0. Why?

I expected results is 20+0=20.

Thanks. Everyone

[cpeteman]

That makes sense. thx.

[sideview]

No, they're not necessary in the language. But when there's ambiguity, once in a while people do misinterpret what the search is doing, so I like to put in the parentheses when there's ambiguity. Along the same lines as the principle of not writing the most advanced code you can - if you do that then only some as good as you or better can read it.

[cpeteman]

Sorry one last comment. Are the parens necessary here? I'm aware of the inherent AND but would:
index=webserver1 OR index=webserver2 type=error | table serverName message method
work the same?

[cpeteman]

No reason to write out more than needed

[cpeteman]

Good point.

[sideview]

Note it makes no sense to run search C. Instead you would run:

(index=webserver1 OR index=webserver2) type=error | table serverName message method

and this will run much faster than using append. Append should be used only as a last resort when faster simpler methods fail.

[cpeteman]

There are two Problems here. The first is that in a subsearch you need to actually write out 'search' in the beginning. Also the order should be different. You first need to append them and the make it a table you can't append a table with a search. Hope this works:

search C: index=webserver1 type=error | append [search index=webserver2 type=error] | table serverName message method

[morethanyell]

should be accepted answer

[cpeteman]

Sure thing.

[joy76]

Thanks for you help.

[imrago]

there is an error in search C, try this:

index=webserver1 type=error | APPEND [search index=webserver2 type=error] | table serverName message method

[cpeteman]

Technically two errors but you fixed them both.