Splunk Search

Hunk: Searching two different virtual indexes using OR: should work?

burwell
SplunkTrust
SplunkTrust

In regular Splunk I can easily search for

index=index1 OR index=index2 <search term> | stats count by index

Then I get results from either index.

When I setup a virtual index in Hunk 6.5.3 searching ORC files and I do a similar query I seem to only get results from one index.
Is there something inherently different in the way Hunk searches that this wouldn't work?

Tags (1)
1 Solution

rdagan_splunk
Splunk Employee
Splunk Employee

It should work in Hunk.
Can I assume that these two queries work without a problem?
index=index1 a=term | stats count by index
index=index2 a=term | stats count by index
but this one does not?
index=index1 OR index=index2 a=term | stats count by index

View solution in original post

rdagan_splunk
Splunk Employee
Splunk Employee

It should work in Hunk.
Can I assume that these two queries work without a problem?
index=index1 a=term | stats count by index
index=index2 a=term | stats count by index
but this one does not?
index=index1 OR index=index2 a=term | stats count by index

View solution in original post

burwell
SplunkTrust
SplunkTrust

Hi Raanan. Your query above is exactly what I was experimenting with.

So I did some more experiments.

  1. If my virtual indexes points to 2 Hive databases, then the query with OR works fine. I get results from two different indexes.
  2. If my virtual indexes point to 2 ORC files, I can only get the results for one.

I will file a support ticket. Thanks for confirming the expected results.

0 Karma
Register for .conf21 Now! Go Vegas or Go Virtual!

How will you .conf21? You decide! Go in-person in Las Vegas, 10/18-10/21, or go online with .conf21 Virtual, 10/19-10/20.