Splunk Search

How to combine two searches with streaming commands?

mgutschelhofer
Explorer

I want to combine two search results, whereby I'm only interested in the last x/y events from each subquery. Something like this:

 

 

| multisearch 
    [search index="sli-index" 
    | eval testtype="endp-health" 
    |  head 3] 
    [search index="sli-index"
    | eval testtype="enp-system" 
    | head 6]

 

 

 This leads to following error: ...Error in 'multisearch' command: Multisearch subsearches might only contain purely streaming operations (subsearch 1 contains a non-streaming command)....

Any idea how this can be achieved?

Labels (1)
0 Karma
1 Solution

mgutschelhofer
Explorer

I tried with append:

index="sli-index" 
    | eval testtype="endp-health" 
    |  head 1 
| append 
    [search index="sli-index"
    | eval testtype="enp-system" 
    | head 1]

 But for some reasons I get two events where testtype=="endp-system".

Expected: I get two events: testtype="endp-health" and the other with testtype="endp-system" 

View solution in original post

0 Karma

PickleRick
SplunkTrust
SplunkTrust

Strange. Works for me.

Screenshot_20220705-075641_Firefox Beta.png

mgutschelhofer
Explorer

Hi,

after putting the result in a table, the result is OK 🙂

For completeness, this now shows correct results:

index="sli-index" 
    | eval testtype="endp-health" 
    |  head 3 
| append 
    [search index="sli-index"
    | eval testtype="enp-system" 
    | head 6]
| table _time, testtype

Many Thanks, you saved my day.

Cheers, Martin

0 Karma

PickleRick
SplunkTrust
SplunkTrust

Now that's interesting because all comands are streaming. Maybe Splunk tried to optimize the search and came up with some non-streaming equivalent and shot itself in the foot. Anyway. If your subsearches are small and quick you can use append.

0 Karma

mgutschelhofer
Explorer

I tried with append:

index="sli-index" 
    | eval testtype="endp-health" 
    |  head 1 
| append 
    [search index="sli-index"
    | eval testtype="enp-system" 
    | head 1]

 But for some reasons I get two events where testtype=="endp-system".

Expected: I get two events: testtype="endp-health" and the other with testtype="endp-system" 

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...