Error While using "append" command

[abhayneilam]

Hi,
I am getting the following error which using "append" command :

Encountered an error while reading file 'C:\Program Files\Splunk\var\run\splunk\dispatchtmp\subsearch_1350988212.241_1350988213.1\prereport_0.csv.gz'

When I am traversing to this directory I can see no data after
'C:\Program Files\Splunk\var\run\splunk\dispatchtmp'

"dispatchtmp" directory has nothing in it.

Please suggest me how to solve this !!

Thanks in Advance

[sowings · Accepted solution]

Are you running 4.3.3? Is the subsearch you're using with append a | rest call? If so, you may have hit a known bug in 4.3.3. Upgrading to 4.3.4 will be necessary for that particular issue. Otherwise, can you give us some more information?

[abhayneilam]

Thanks a lot !! .. 🙂

[sowings]

Yes, try using fields to see if that corrects your issue. Then, you can upgrade to 4.3.4 at your convenience.

[abhayneilam]

In my search I am using "table" command in "inner" as well as "outer" search both, should I use "fields" command instead of "table" every where ?

Please suggest !!

[sowings]

The release notes for 4.3.4 are here. They suggest that you're seeing bug SPL-52862. If you're unable to upgrade at this time, you can work around the issue by using | fields <fields_you_want> at the end of your subsearch. The list of fields should be those which are referenced by the calling (outer) search.

[abhayneilam]

yaa , I am running 4.3.3 version.
Moreover, I am trying to append the results of two searches. Please find the snipet:

index="xyz" | firstsearch | append [ search index="xyz" | secondsearch ]

Please suggest me how to solve this append error,