Splunk Search

Subquery Does Not Return Any Result

pramit46
Contributor

I have two different sourcetypes: S1 and S2 (under different indexes)

I want to print, three extracted custom fields from those two sourcetypes: F1 & F2 (belong to S1) and F3 (belongs to S2). I used the following query:

sourcetype= S1 or sourcetype= S2 | fields F1, F2, F3

It shows "No results found."

Basically, my motive is to print the values of certain fields from these two sourcetypes including F1, F2 & F3.

When I use: sourcetype= S1 | fields F1, F2 it comes up nice.

F1, F2, F3 can be multivalued fields which may or may not contain same values.

Any suggestions?

0 Karma
1 Solution

MuS
SplunkTrust
SplunkTrust

Hi pramit46,

Your search brings no result, because you will not have any events containing all three fields. You only have either F1 and F2 or F3.

But to get all three fields try something like this:

 sourcetype=S1 OR sourcetype=S2 | stats values(F1) AS F1, values(F2) AS F2, values(F3) AS F3 

hope this helps ...

cheers, MuS

View solution in original post

MuS
SplunkTrust
SplunkTrust

Hi pramit46,

Your search brings no result, because you will not have any events containing all three fields. You only have either F1 and F2 or F3.

But to get all three fields try something like this:

 sourcetype=S1 OR sourcetype=S2 | stats values(F1) AS F1, values(F2) AS F2, values(F3) AS F3 

hope this helps ...

cheers, MuS

pramit46
Contributor

Thanks @MuS,
I tried that, too.. But did not get much luck. then I realized that I had to use the or as OR and it worked.

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...