Splunk Search

Use of multireport crashed after Update to 8.2.2

haph
Path Finder

Hello guys!

 

I use some reports with the 

 

 | multireport

 

command like this: 

 

...search...

| multireport
    [
    | table _time L5PS1GutStk
      
     | sort + _time
     | where L5PS1GutStk!=""
     
     | autoregress L5PS1GutStk
     | reverse
     | fillnull
     | stats count(eval(L5PS1GutStk!=L5PS1GutStk_p1 AND L5PS1GutStk!=0)) as passes1
    
     
     ]
    [
     | table _time L5PS2GutStk 
     | sort + _time
     | where L5PS2GutStk!=""
     
     | autoregress L5PS2GutStk
     | reverse
     | fillnull
     | stats count(eval(L5PS2GutStk!=L5PS2GutStk_p1 AND L5PS2GutStk!=0)) as passes2
     
     ]

...rest of the search...

 

 This worked until yesterday, when Splunk was updatet from 7.3.3 to 8.2.2. 

Then this error occured:

2021-09-22 17_49_45-Start.png2021-09-22 17_50_06-Start.png

It had to be fixed very fast so we created a simpler but more wrong search.

Today I was further investigating what went wrong and causes this issue. 

If first thought of the not documented multireport command and that this command was removed or something in the new version. But my colleague had a similar search with multireport and it still worked. I removed the whole multireport and it worked again so somethin with the multireport was wrong. Then I removed line after line for its own in the subsearches to figure out the source of the problem. 

Finally after removing the |table command in the first line of each subsearch, the whole search was working again!! I found the source. I replaced the table with the field command and everything works well again, crisis averted. I then tested another thing: Just replacing |table with |fields in only 1 subsearch. --> It worked again, no error. 

 

So my question to you guys is: Does anybody know what went wrong here and what are the differences in the Splunk versions to produce this error?

Thanks!!

 

PS to the Splunk Team: Please never delete the multireport and make it official, it is a very useful command!

Labels (1)
Tags (3)
0 Karma
Get Updates on the Splunk Community!

.conf24 | Day 0

Hello Splunk Community! My name is Chris, and I'm based in Canberra, Australia's capital, and I travelled for ...

Enhance Security Visibility with Splunk Enterprise Security 7.1 through Threat ...

 (view in My Videos)Struggling with alert fatigue, lack of context, and prioritization around security ...

Troubleshooting the OpenTelemetry Collector

  In this tech talk, you’ll learn how to troubleshoot the OpenTelemetry collector - from checking the ...