Splunk Search

Use of multireport crashed after Update to 8.2.2

haph
Path Finder

Hello guys!

 

I use some reports with the 

 

 | multireport

 

command like this: 

 

...search...

| multireport
    [
    | table _time L5PS1GutStk
      
     | sort + _time
     | where L5PS1GutStk!=""
     
     | autoregress L5PS1GutStk
     | reverse
     | fillnull
     | stats count(eval(L5PS1GutStk!=L5PS1GutStk_p1 AND L5PS1GutStk!=0)) as passes1
    
     
     ]
    [
     | table _time L5PS2GutStk 
     | sort + _time
     | where L5PS2GutStk!=""
     
     | autoregress L5PS2GutStk
     | reverse
     | fillnull
     | stats count(eval(L5PS2GutStk!=L5PS2GutStk_p1 AND L5PS2GutStk!=0)) as passes2
     
     ]

...rest of the search...

 

 This worked until yesterday, when Splunk was updatet from 7.3.3 to 8.2.2. 

Then this error occured:

2021-09-22 17_49_45-Start.png2021-09-22 17_50_06-Start.png

It had to be fixed very fast so we created a simpler but more wrong search.

Today I was further investigating what went wrong and causes this issue. 

If first thought of the not documented multireport command and that this command was removed or something in the new version. But my colleague had a similar search with multireport and it still worked. I removed the whole multireport and it worked again so somethin with the multireport was wrong. Then I removed line after line for its own in the subsearches to figure out the source of the problem. 

Finally after removing the |table command in the first line of each subsearch, the whole search was working again!! I found the source. I replaced the table with the field command and everything works well again, crisis averted. I then tested another thing: Just replacing |table with |fields in only 1 subsearch. --> It worked again, no error. 

 

So my question to you guys is: Does anybody know what went wrong here and what are the differences in the Splunk versions to produce this error?

Thanks!!

 

PS to the Splunk Team: Please never delete the multireport and make it official, it is a very useful command!

Labels (1)
Tags (3)
0 Karma
Get Updates on the Splunk Community!

Announcing Scheduled Export GA for Dashboard Studio

We're excited to announce the general availability of Scheduled Export for Dashboard Studio. Starting in ...

Extending Observability Content to Splunk Cloud

Watch Now!   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to leverage ...

More Control Over Your Monitoring Costs with Archived Metrics GA in US-AWS!

What if there was a way you could keep all the metrics data you need while saving on storage costs?This is now ...