Splunk Search

Append 2 tables. Gets "Missing or malformed messages.conf stanza for SEARCHFACTORY:UNKNOWN_OP__index" error

Path Finder

I am trying to append to search results which displays the same column headers. However I am getting the error: Missing or malformed messages.conf stanza for SEARCHFACTORY:UNKNOWNOP_index

index="main" 
| stats sum(effort) as value by category
| append 
[ index="main" |  stats count as value by category ]
Tags (1)
0 Karma
1 Solution

Esteemed Legend

You are missing the keyword search inside of your subsearch; try this:

index="main" | stats sum(effort) as value by category 
| append [ search index="main" | stats count as value by category ]

But there is a better way; try this:

index="main" 
| multireport
[ stats sum(effort) AS value BY category ]
[ stats count AS value BY category ]

Or best of all, this:

index="main" 
| stats sum(effort) AS effort count AS count BY category

View solution in original post

Path Finder

index="main"
| eval metricname = "count:effort"
| eval metric
name = split(metricname,":")
| mvexpand metric
name
| eval value = case(metricname="count", 1, metricname="effort", effort)
| table metric
name, _value, category

0 Karma

Esteemed Legend

You are missing the keyword search inside of your subsearch; try this:

index="main" | stats sum(effort) as value by category 
| append [ search index="main" | stats count as value by category ]

But there is a better way; try this:

index="main" 
| multireport
[ stats sum(effort) AS value BY category ]
[ stats count AS value BY category ]

Or best of all, this:

index="main" 
| stats sum(effort) AS effort count AS count BY category

View solution in original post