Splunk Search

How to combine two searches with streaming commands?

mgutschelhofer
Explorer

I want to combine two search results, whereby I'm only interested in the last x/y events from each subquery. Something like this:

 

 

| multisearch 
    [search index="sli-index" 
    | eval testtype="endp-health" 
    |  head 3] 
    [search index="sli-index"
    | eval testtype="enp-system" 
    | head 6]

 

 

 This leads to following error: ...Error in 'multisearch' command: Multisearch subsearches might only contain purely streaming operations (subsearch 1 contains a non-streaming command)....

Any idea how this can be achieved?

Labels (1)
0 Karma
1 Solution

mgutschelhofer
Explorer

I tried with append:

index="sli-index" 
    | eval testtype="endp-health" 
    |  head 1 
| append 
    [search index="sli-index"
    | eval testtype="enp-system" 
    | head 1]

 But for some reasons I get two events where testtype=="endp-system".

Expected: I get two events: testtype="endp-health" and the other with testtype="endp-system" 

View solution in original post

0 Karma

jolenescott
Observer

Hello Splunk Community,

To combine two search results where you are interested in the last x/y events from each subquery, you can utilize streaming commands effectively by piping the output of the first search into the second one. For instance, you can use command-line tools like grep, awk, or sed to filter and merge the results. If you're dealing with more complex data, consider using a programming language like Python with libraries such as pandas for better manipulation and merging of search results. Finally, to enhance your streaming and searching experience, I recommend you install the Spotify Web Mod PC. This mod can help streamline your music searches and organize your playlists efficiently, providing a seamless integration into your overall workflow.

Best Regards!!

0 Karma

PickleRick
SplunkTrust
SplunkTrust

Strange. Works for me.

Screenshot_20220705-075641_Firefox Beta.png

mgutschelhofer
Explorer

Hi,

after putting the result in a table, the result is OK 🙂

For completeness, this now shows correct results:

index="sli-index" 
    | eval testtype="endp-health" 
    |  head 3 
| append 
    [search index="sli-index"
    | eval testtype="enp-system" 
    | head 6]
| table _time, testtype

Many Thanks, you saved my day.

Cheers, Martin

0 Karma

PickleRick
SplunkTrust
SplunkTrust

Now that's interesting because all comands are streaming. Maybe Splunk tried to optimize the search and came up with some non-streaming equivalent and shot itself in the foot. Anyway. If your subsearches are small and quick you can use append.

0 Karma

mgutschelhofer
Explorer

I tried with append:

index="sli-index" 
    | eval testtype="endp-health" 
    |  head 1 
| append 
    [search index="sli-index"
    | eval testtype="enp-system" 
    | head 1]

 But for some reasons I get two events where testtype=="endp-system".

Expected: I get two events: testtype="endp-health" and the other with testtype="endp-system" 

0 Karma
Get Updates on the Splunk Community!

Stay Connected: Your Guide to July and August Tech Talks, Office Hours, and Webinars!

Dive into our sizzling summer lineup for July and August Community Office Hours and Tech Talks. Scroll down to ...

Edge Processor Scaling, Energy & Manufacturing Use Cases, and More New Articles on ...

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...

Get More Out of Your Security Practice With a SIEM

Get More Out of Your Security Practice With a SIEMWednesday, July 31, 2024  |  11AM PT / 2PM ETREGISTER ...