Splunk Search

Subquery Does Not Return Any Result

Contributor

I have two different sourcetypes: S1 and S2 (under different indexes)

I want to print, three extracted custom fields from those two sourcetypes: F1 & F2 (belong to S1) and F3 (belongs to S2). I used the following query:

sourcetype= S1 or sourcetype= S2 | fields F1, F2, F3

It shows "No results found."

Basically, my motive is to print the values of certain fields from these two sourcetypes including F1, F2 & F3.

When I use: sourcetype= S1 | fields F1, F2 it comes up nice.

F1, F2, F3 can be multivalued fields which may or may not contain same values.

Any suggestions?

0 Karma
1 Solution

SplunkTrust
SplunkTrust

Hi pramit46,

Your search brings no result, because you will not have any events containing all three fields. You only have either F1 and F2 or F3.

But to get all three fields try something like this:

 sourcetype=S1 OR sourcetype=S2 | stats values(F1) AS F1, values(F2) AS F2, values(F3) AS F3 

hope this helps ...

cheers, MuS

View solution in original post

SplunkTrust
SplunkTrust

Hi pramit46,

Your search brings no result, because you will not have any events containing all three fields. You only have either F1 and F2 or F3.

But to get all three fields try something like this:

 sourcetype=S1 OR sourcetype=S2 | stats values(F1) AS F1, values(F2) AS F2, values(F3) AS F3 

hope this helps ...

cheers, MuS

View solution in original post

Contributor

Thanks @MuS,
I tried that, too.. But did not get much luck. then I realized that I had to use the or as OR and it worked.

0 Karma
State of Splunk Careers

Access the Splunk Careers Report to see real data that shows how Splunk mastery increases your value and job satisfaction.

Find out what your skills are worth!