Splunk Search

Error While using "append" command

abhayneilam
Contributor

Hi,
I am getting the following error which using "append" command :

Encountered an error while reading file 'C:\Program Files\Splunk\var\run\splunk\dispatchtmp\subsearch_1350988212.241_1350988213.1\prereport_0.csv.gz'

When I am traversing to this directory I can see no data after
'C:\Program Files\Splunk\var\run\splunk\dispatchtmp'

"dispatchtmp" directory has nothing in it.

Please suggest me how to solve this !!

Thanks in Advance

Tags (4)
0 Karma
1 Solution

sowings
Splunk Employee
Splunk Employee

Are you running 4.3.3? Is the subsearch you're using with append a | rest call? If so, you may have hit a known bug in 4.3.3. Upgrading to 4.3.4 will be necessary for that particular issue. Otherwise, can you give us some more information?

View solution in original post

0 Karma

sowings
Splunk Employee
Splunk Employee

Are you running 4.3.3? Is the subsearch you're using with append a | rest call? If so, you may have hit a known bug in 4.3.3. Upgrading to 4.3.4 will be necessary for that particular issue. Otherwise, can you give us some more information?

View solution in original post

0 Karma

abhayneilam
Contributor

Thanks a lot !! .. 🙂

0 Karma

sowings
Splunk Employee
Splunk Employee

Yes, try using fields to see if that corrects your issue. Then, you can upgrade to 4.3.4 at your convenience.

0 Karma

abhayneilam
Contributor

In my search I am using "table" command in "inner" as well as "outer" search both, should I use "fields" command instead of "table" every where ?

Please suggest !!

0 Karma

sowings
Splunk Employee
Splunk Employee

The release notes for 4.3.4 are here. They suggest that you're seeing bug SPL-52862. If you're unable to upgrade at this time, you can work around the issue by using | fields <fields_you_want> at the end of your subsearch. The list of fields should be those which are referenced by the calling (outer) search.

0 Karma

abhayneilam
Contributor

yaa , I am running 4.3.3 version.
Moreover, I am trying to append the results of two searches. Please find the snipet:

index="xyz" | firstsearch | append [ search index="xyz" | secondsearch ]

Please suggest me how to solve this append error,

0 Karma
Did you miss .conf21 Virtual?

Good news! The event's keynotes and many of its breakout sessions are now available online, and still totally FREE!