Splunk Search

How to combine two searches with streaming commands?

mgutschelhofer
Explorer

I want to combine two search results, whereby I'm only interested in the last x/y events from each subquery. Something like this:

 

 

| multisearch 
    [search index="sli-index" 
    | eval testtype="endp-health" 
    |  head 3] 
    [search index="sli-index"
    | eval testtype="enp-system" 
    | head 6]

 

 

 This leads to following error: ...Error in 'multisearch' command: Multisearch subsearches might only contain purely streaming operations (subsearch 1 contains a non-streaming command)....

Any idea how this can be achieved?

Labels (1)
0 Karma
1 Solution

mgutschelhofer
Explorer

I tried with append:

index="sli-index" 
    | eval testtype="endp-health" 
    |  head 1 
| append 
    [search index="sli-index"
    | eval testtype="enp-system" 
    | head 1]

 But for some reasons I get two events where testtype=="endp-system".

Expected: I get two events: testtype="endp-health" and the other with testtype="endp-system" 

View solution in original post

0 Karma

jolenescott
Observer

Hello Splunk Community,

To combine two search results where you are interested in the last x/y events from each subquery, you can utilize streaming commands effectively by piping the output of the first search into the second one. For instance, you can use command-line tools like grep, awk, or sed to filter and merge the results. If you're dealing with more complex data, consider using a programming language like Python with libraries such as pandas for better manipulation and merging of search results. Finally, to enhance your streaming and searching experience, I recommend you install the Spotify Web Mod PC. This mod can help streamline your music searches and organize your playlists efficiently, providing a seamless integration into your overall workflow.

Best Regards!!

0 Karma

PickleRick
SplunkTrust
SplunkTrust

Strange. Works for me.

Screenshot_20220705-075641_Firefox Beta.png

mgutschelhofer
Explorer

Hi,

after putting the result in a table, the result is OK 🙂

For completeness, this now shows correct results:

index="sli-index" 
    | eval testtype="endp-health" 
    |  head 3 
| append 
    [search index="sli-index"
    | eval testtype="enp-system" 
    | head 6]
| table _time, testtype

Many Thanks, you saved my day.

Cheers, Martin

0 Karma

PickleRick
SplunkTrust
SplunkTrust

Now that's interesting because all comands are streaming. Maybe Splunk tried to optimize the search and came up with some non-streaming equivalent and shot itself in the foot. Anyway. If your subsearches are small and quick you can use append.

0 Karma

mgutschelhofer
Explorer

I tried with append:

index="sli-index" 
    | eval testtype="endp-health" 
    |  head 1 
| append 
    [search index="sli-index"
    | eval testtype="enp-system" 
    | head 1]

 But for some reasons I get two events where testtype=="endp-system".

Expected: I get two events: testtype="endp-health" and the other with testtype="endp-system" 

0 Karma
Get Updates on the Splunk Community!

Uncovering Multi-Account Fraud with Splunk Banking Analytics

Last month, I met with a Senior Fraud Analyst at a nationally recognized bank to discuss their recent success ...

Secure Your Future: A Deep Dive into the Compliance and Security Enhancements for the ...

What has been announced?  In the blog, “Preparing your Splunk Environment for OpensSSL3,”we announced the ...

New This Month in Splunk Observability Cloud - Synthetic Monitoring updates, UI ...

This month, we’re delivering several platform, infrastructure, application and digital experience monitoring ...