Splunk Search

Error when using append and join-- Search Factory: Unknown search command 'index'.

kteng2024
Path Finder

Hi ,

Below are the two queries for which I am trying to join the output of the both queries but I am facing an issue as Search Factory: Unknown search command 'index'.

First query

index=apache* sourcetype=access_log
host=xyz OR host=abc | timechart
span=10m count as requests_per_minute

Second query

index=apache* sourcetype=web_logs
host=cde OR host=wxy | table BClog

When I tried the both append and join it is not working .

index=apache* sourcetype=access_log
host=xyz OR host=abc | timechart
span=10m count as requests_per_minute
| join [ index=apache*
sourcetype=web_logs host=cde OR
host=wxy | table BClog ]

index=apache* sourcetype=access_log
host=xyz OR host=abc | timechart
span=10m count as requests_per_minute
| append [ index=apache*
sourcetype=web_logs host=cde OR
host=wxy | table BClog ]

0 Karma

niketn
Legend

@kteng2024, add search in the subquery and try.

index=apache* sourcetype=access_log
host=xyz OR host=abc | timechart
span=10m count as requests_per_minute
| append [ search index=apache*
sourcetype=web_logs host=cde OR
host=wxy | table BClog ]
____________________________________________
| makeresults | eval message= "Happy Splunking!!!"
Get Updates on the Splunk Community!

Splunk Observability Cloud’s AI Assistant in Action Series: Analyzing and ...

This is the second post in our Splunk Observability Cloud’s AI Assistant in Action series, in which we look at ...

Elevate Your Organization with Splunk’s Next Platform Evolution

 Thursday, July 10, 2025  |  11AM PDT / 2PM EDT Whether you're managing complex deployments or looking to ...

Splunk Answers Content Calendar, June Edition

Get ready for this week’s post dedicated to Splunk Dashboards! We're celebrating the power of community by ...