How to append the results of one search to another?

[raby1996]

Hello,

I'm using the search below to collect errors that have occurred on specific machines, however, I need to use two different searches because the data is split amongst two indexes and source types. When I try using the append command, I only get the results of the first search. Is there any reason as to why this may happening? Thank you in advance.

index=hb_probtxt or hb_probxml  sourcetype=AllProblems.txt or AllProblems.xml eventtype=nix_errors
     | rex "(?m)storageFacilityMTMS.*?=(?<sf>\S+)"
     | rex "(?m)referenceCode.*?=(?<rc>BE\w+)"
     | rex  field=firstReportedTime "(?<cf>\S+\s+\S+)"
     | dedup sf, rc, cf
     | stats list(rc) as "SRC Code"  list(firstReportedTime) as "Date of Occurence" by sf| rename sf as "MTMS"
     |append [search index=hb_probxml  sourcetype="AllProblems.xml" 
     | rex "(?m)storageFacilityMTMS.*?\"(?<sf>.*?)\""
     | rex "(?m) referenceCode.*?\"(?<rc>.*?)\""
     |  rex "(?m)SEText.*?\"(?<st>.*?)\""
     | rex field=collectionTimeStamp "(?<cs>\w+)"
     | dedup cs, sf, rc
     | stats list(rc) as "SRC Code" list(collectionTimeStamp) as "Date of Occurence" by sf | rename sf as "MTMS" ]               

[somesoni2 · Accepted solution]

I do not see any issue with your search here. It could be that append subsearch is getting timedout before it's complete. Also, just to be sure, try this to confirm you're not seeing any events from 2nd search

 index=hb_probtxt or hb_probxml  sourcetype=AllProblems.txt or AllProblems.xml eventtype=nix_errors
     | rex "(?m)storageFacilityMTMS.*?=(?<sf>\S+)"
     | rex "(?m)referenceCode.*?=(?<rc>BE\w+)"
     | rex  field=firstReportedTime "(?<cf>\S+\s+\S+)"
     | dedup sf, rc, cf
     | stats list(rc) as "SRC Code"  list(firstReportedTime) as "Date of Occurence" by sf| rename sf as "MTMS" | eval From=1
     |append [search index=hb_probxml  sourcetype="AllProblems.xml" 
     | rex "(?m)storageFacilityMTMS.*?\"(?<sf>.*?)\""
     | rex "(?m) referenceCode.*?\"(?<rc>.*?)\""
     |  rex "(?m)SEText.*?\"(?<st>.*?)\""
     | rex field=collectionTimeStamp "(?<cs>\w+)"
     | dedup cs, sf, rc
     | stats list(rc) as "SRC Code" list(collectionTimeStamp) as "Date of Occurence" by sf | rename sf as "MTMS"  | eval From=2 ] | where From=2

[raby1996]

Yes I think that was the Problem, I ended up searching multiple indexes using the OR boolean, and its working. I appreciate the help, however I was required to delete the posting, still Thank You!

[gyslainlatsa]

hi raby1996,

Appends the results of a subsearch to the current results. The append command runs only over historical data and does not produce correct results if used in a real-time search.

try use appendcols Or join

[raby1996]

hmmm I'm not sure if those would work, basically I want to run those two searches and add the results together, not match or overwrite anything (which is by my understating what appendcols and join do). Here is an example, Thank you!

Search 1 Results-
MTMS SRC Code Date of Occurrence
1 2 01/01/16
2 5 02/01/16

Search 2 Results-
MTMS SRC Code Date of Occurrence
3 3 12/01/15
4 5 11/01/15

Desired Results-
MTMS SRC Code Date of Occurrence
1 2 01/01/16
2 5 02/01/16
3 3 12/01/15
4 5 11/01/15

[gyslainlatsa]

follow this link: https://answers.splunk.com/answers/144351/what-are-the-differences-between-append-appendpipe.html