How to search multiple virtual indexes with Splunk Analytics for Hadoop?

[EricLloyd79]

Hello, we currently have two virtual indexes with data in them retrieving data from Hadoop Distributed File System.
We want to run one query to search over both indexes.
I hoped that:
index=abc OR index=xyz "keyword"
would work correctly but it only returns values from index=abc.
Anyone got any idea on how to search multiple indexes?

[rdagan_splunk]

I just tried it without any issues.
I tried both index=xyz OR index=abc somekeyword as well as (index=abc somekey=somevalue) OR (index="xyz" somekey=somevalue)

[EricLloyd79]

Weird, I wonder why my version isn't working. thanks.

[burwell]

Hi Eric. What version of Splunk are you running?

So I saw a similar issue: https://answers.splunk.com/answers/536338/hunk-searching-two-different-virtual-indexes-using.html

I've upgraded all our Splunk instances to Splunk 6.6 and I cannot reproduce this error.

[somesoni2]

Does the index=xyz "keyword" returns result when run separately?

[EricLloyd79]

Yes each one returns individual results.