Splunk Search

How to search multiple virtual indexes with Splunk Analytics for Hadoop?

EricLloyd79
Builder

Hello, we currently have two virtual indexes with data in them retrieving data from Hadoop Distributed File System.
We want to run one query to search over both indexes.
I hoped that:
index=abc OR index=xyz "keyword"
would work correctly but it only returns values from index=abc.
Anyone got any idea on how to search multiple indexes?

0 Karma

rdagan_splunk
Splunk Employee
Splunk Employee

I just tried it without any issues.
I tried both index=xyz OR index=abc somekeyword as well as (index=abc somekey=somevalue) OR (index="xyz" somekey=somevalue)

0 Karma

EricLloyd79
Builder

Weird, I wonder why my version isn't working. thanks.

0 Karma

burwell
SplunkTrust
SplunkTrust

Hi Eric. What version of Splunk are you running?

So I saw a similar issue: https://answers.splunk.com/answers/536338/hunk-searching-two-different-virtual-indexes-using.html

I've upgraded all our Splunk instances to Splunk 6.6 and I cannot reproduce this error.

0 Karma

somesoni2
Revered Legend

Does the index=xyz "keyword" returns result when run separately?

0 Karma

EricLloyd79
Builder

Yes each one returns individual results.

0 Karma
Get Updates on the Splunk Community!

Splunk Observability for AI

Don’t miss out on an exciting Tech Talk on Splunk Observability for AI!Discover how Splunk’s agentic AI ...

🔐 Trust at Every Hop: How mTLS in Splunk Enterprise 10.0 Makes Security Simpler

From Idea to Implementation: Why Splunk Built mTLS into Splunk Enterprise 10.0  mTLS wasn’t just a checkbox ...

Observe and Secure All Apps with Splunk

  Join Us for Our Next Tech Talk: Observe and Secure All Apps with SplunkAs organizations continue to innovate ...