Splunk Search

Error While using "append" command

abhayneilam
Contributor

Hi,
I am getting the following error which using "append" command :

Encountered an error while reading file 'C:\Program Files\Splunk\var\run\splunk\dispatchtmp\subsearch_1350988212.241_1350988213.1\prereport_0.csv.gz'

When I am traversing to this directory I can see no data after
'C:\Program Files\Splunk\var\run\splunk\dispatchtmp'

"dispatchtmp" directory has nothing in it.

Please suggest me how to solve this !!

Thanks in Advance

Tags (4)
0 Karma
1 Solution

sowings
Splunk Employee
Splunk Employee

Are you running 4.3.3? Is the subsearch you're using with append a | rest call? If so, you may have hit a known bug in 4.3.3. Upgrading to 4.3.4 will be necessary for that particular issue. Otherwise, can you give us some more information?

View solution in original post

0 Karma

sowings
Splunk Employee
Splunk Employee

Are you running 4.3.3? Is the subsearch you're using with append a | rest call? If so, you may have hit a known bug in 4.3.3. Upgrading to 4.3.4 will be necessary for that particular issue. Otherwise, can you give us some more information?

0 Karma

abhayneilam
Contributor

Thanks a lot !! .. 🙂

0 Karma

sowings
Splunk Employee
Splunk Employee

Yes, try using fields to see if that corrects your issue. Then, you can upgrade to 4.3.4 at your convenience.

0 Karma

abhayneilam
Contributor

In my search I am using "table" command in "inner" as well as "outer" search both, should I use "fields" command instead of "table" every where ?

Please suggest !!

0 Karma

sowings
Splunk Employee
Splunk Employee

The release notes for 4.3.4 are here. They suggest that you're seeing bug SPL-52862. If you're unable to upgrade at this time, you can work around the issue by using | fields <fields_you_want> at the end of your subsearch. The list of fields should be those which are referenced by the calling (outer) search.

0 Karma

abhayneilam
Contributor

yaa , I am running 4.3.3 version.
Moreover, I am trying to append the results of two searches. Please find the snipet:

index="xyz" | firstsearch | append [ search index="xyz" | secondsearch ]

Please suggest me how to solve this append error,

0 Karma
Get Updates on the Splunk Community!

Index This | What goes away as soon as you talk about it?

May 2025 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with this month’s ...

What's New in Splunk Observability Cloud and Splunk AppDynamics - May 2025

This month, we’re delivering several new innovations in Splunk Observability Cloud and Splunk AppDynamics ...

Getting Started with Splunk Artificial Intelligence, Insights for Nonprofits, and ...

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...