How to combine two searches with streaming commands?

[mgutschelhofer]

I want to combine two search results, whereby I'm only interested in the last x/y events from each subquery. Something like this:

| multisearch 
    [search index="sli-index" 
    | eval testtype="endp-health" 
    |  head 3] 
    [search index="sli-index"
    | eval testtype="enp-system" 
    | head 6]

 This leads to following error: ...Error in 'multisearch' command: Multisearch subsearches might only contain purely streaming operations (subsearch 1 contains a non-streaming command)....

Any idea how this can be achieved?

[jolenescott]

Hello Splunk Community,

To combine two search results where you are interested in the last x/y events from each subquery, you can utilize streaming commands effectively by piping the output of the first search into the second one. For instance, you can use command-line tools like grep, awk, or sed to filter and merge the results. If you're dealing with more complex data, consider using a programming language like Python with libraries such as pandas for better manipulation and merging of search results. Finally, to enhance your streaming and searching experience, I recommend you install the Spotify Web Mod PC. This mod can help streamline your music searches and organize your playlists efficiently, providing a seamless integration into your overall workflow.

Best Regards!!

[PickleRick]

Strange. Works for me.

 

[mgutschelhofer]

Hi,

after putting the result in a table, the result is OK 🙂

For completeness, this now shows correct results:

index="sli-index" 
    | eval testtype="endp-health" 
    |  head 3 
| append 
    [search index="sli-index"
    | eval testtype="enp-system" 
    | head 6]
| table _time, testtype

Many Thanks, you saved my day.

Cheers, Martin

[PickleRick]

Now that's interesting because all comands are streaming. Maybe Splunk tried to optimize the search and came up with some non-streaming equivalent and shot itself in the foot. Anyway. If your subsearches are small and quick you can use append.

[mgutschelhofer · Accepted solution]

I tried with append:

index="sli-index" 
    | eval testtype="endp-health" 
    |  head 1 
| append 
    [search index="sli-index"
    | eval testtype="enp-system" 
    | head 1]

 But for some reasons I get two events where testtype=="endp-system".

Expected: I get two events: testtype="endp-health" and the other with testtype="endp-system"