Appended search not appearing in timeline results

[dondky]

All, I'm executing the following search:

eventtype=opsec_drop 127.0.0.1 tcp_flags="PUSH-ACK" | append [search sourcetype=access_combined source="/var/log/httpd/example_*"]

However the appended search results are not viewable via the time line. I do see however the events from the first search for the firewall logs. The goal was to combine both the firewall logs + the web server logs to see if we could notice a pattern and spot some irregularities.

Thanks

[martin_mueller]

You could just do this

(eventtype=opsec_drop 127.0.0.1 tcp_flags="PUSH-ACK") OR (sourcetype=access_combined source="/var/log/httpd/example_*")

to avoid the whole subsearch-append malarkey.

[martin_mueller]

That's true, "short-circuit" evaluation for OR means you stop evaluating once you've found one true branch. However, that's checked per event. Once an event is found to match the first branch of the OR, there's no need to check the second branch because the overall result already is true. That doesn't affect other events.

Note, this isn't exactly the same search as yours. If an event matches both conditions, your append search would return it twice while my OR search would return it once.

If your question is solved, do mark it as such by pressing the check mark to the left.

[dondky]

For some reason in my head OR represents if the first search executes don't proceed in displaying the search results from the second. But surrounding everything in ( ) works.

Thanks