Splunk Search

Append 2 tables. Gets "Missing or malformed messages.conf stanza for SEARCHFACTORY:UNKNOWN_OP__index" error

niyaz006
Path Finder

I am trying to append to search results which displays the same column headers. However I am getting the error: Missing or malformed messages.conf stanza for SEARCHFACTORY:UNKNOWN_OP__index

index="main" 
| stats sum(effort) as value by category
| append 
[ index="main" |  stats count as value by category ]
Tags (1)
0 Karma
1 Solution

woodcock
Esteemed Legend

You are missing the keyword search inside of your subsearch; try this:

index="main" | stats sum(effort) as value by category 
| append [ search index="main" | stats count as value by category ]

But there is a better way; try this:

index="main" 
| multireport
[ stats sum(effort) AS value BY category ]
[ stats count AS value BY category ]

Or best of all, this:

index="main" 
| stats sum(effort) AS effort count AS count BY category

View solution in original post

niyaz006
Path Finder

index="main"
| eval metric_name = "count:effort"
| eval metric_name = split(metric_name,":")
| mvexpand metric_name
| eval _value = case(metric_name="count", 1, metric_name="effort", effort)
| table metric_name, _value, category

0 Karma

woodcock
Esteemed Legend

You are missing the keyword search inside of your subsearch; try this:

index="main" | stats sum(effort) as value by category 
| append [ search index="main" | stats count as value by category ]

But there is a better way; try this:

index="main" 
| multireport
[ stats sum(effort) AS value BY category ]
[ stats count AS value BY category ]

Or best of all, this:

index="main" 
| stats sum(effort) AS effort count AS count BY category
Get Updates on the Splunk Community!

Buttercup Games: Further Dashboarding Techniques (Part 3)

This series of blogs assumes you have already completed the Splunk Enterprise Search Tutorial as it uses the ...

Digital Resilience Assessment Launch | How prepared are you for disruption?

Disruption is inevitable. The question is – how prepared are you to handle it? In today’s fast-moving digital ...

Buttercup Games: Further Dashboarding Techniques (Part 2)

This series of blogs assumes you have already completed the Splunk Enterprise Search Tutorial as it uses the ...