Splunk Search

How to combine two searches with streaming commands?

mgutschelhofer
Explorer

I want to combine two search results, whereby I'm only interested in the last x/y events from each subquery. Something like this:

 

 

| multisearch 
    [search index="sli-index" 
    | eval testtype="endp-health" 
    |  head 3] 
    [search index="sli-index"
    | eval testtype="enp-system" 
    | head 6]

 

 

 This leads to following error: ...Error in 'multisearch' command: Multisearch subsearches might only contain purely streaming operations (subsearch 1 contains a non-streaming command)....

Any idea how this can be achieved?

Labels (1)
0 Karma
1 Solution

mgutschelhofer
Explorer

I tried with append:

index="sli-index" 
    | eval testtype="endp-health" 
    |  head 1 
| append 
    [search index="sli-index"
    | eval testtype="enp-system" 
    | head 1]

 But for some reasons I get two events where testtype=="endp-system".

Expected: I get two events: testtype="endp-health" and the other with testtype="endp-system" 

View solution in original post

0 Karma

jolenescott
Observer

Hello Splunk Community,

To combine two search results where you are interested in the last x/y events from each subquery, you can utilize streaming commands effectively by piping the output of the first search into the second one. For instance, you can use command-line tools like grep, awk, or sed to filter and merge the results. If you're dealing with more complex data, consider using a programming language like Python with libraries such as pandas for better manipulation and merging of search results. Finally, to enhance your streaming and searching experience, I recommend you install the Spotify Web Mod PC. This mod can help streamline your music searches and organize your playlists efficiently, providing a seamless integration into your overall workflow.

Best Regards!!

0 Karma

PickleRick
SplunkTrust
SplunkTrust

Strange. Works for me.

Screenshot_20220705-075641_Firefox Beta.png

mgutschelhofer
Explorer

Hi,

after putting the result in a table, the result is OK 🙂

For completeness, this now shows correct results:

index="sli-index" 
    | eval testtype="endp-health" 
    |  head 3 
| append 
    [search index="sli-index"
    | eval testtype="enp-system" 
    | head 6]
| table _time, testtype

Many Thanks, you saved my day.

Cheers, Martin

0 Karma

PickleRick
SplunkTrust
SplunkTrust

Now that's interesting because all comands are streaming. Maybe Splunk tried to optimize the search and came up with some non-streaming equivalent and shot itself in the foot. Anyway. If your subsearches are small and quick you can use append.

0 Karma

mgutschelhofer
Explorer

I tried with append:

index="sli-index" 
    | eval testtype="endp-health" 
    |  head 1 
| append 
    [search index="sli-index"
    | eval testtype="enp-system" 
    | head 1]

 But for some reasons I get two events where testtype=="endp-system".

Expected: I get two events: testtype="endp-health" and the other with testtype="endp-system" 

0 Karma
Get Updates on the Splunk Community!

Now Playing: Splunk Education Summer Learning Premieres

It’s premiere season, and Splunk Education is rolling out new releases you won’t want to miss. Whether you’re ...

The Visibility Gap: Hybrid Networks and IT Services

The most forward thinking enterprises among us see their network as much more than infrastructure – it's their ...

Get Operational Insights Quickly with Natural Language on the Splunk Platform

In today’s fast-paced digital world, turning data into actionable insights is essential for success. With ...