Splunk Search

Why can't I use multisearch here?

khevans
Path Finder

I'm trying to use Multisearch to combine the results of two commands. My search is:

| multisearch 
    [ search index=... sourcetype=access_combined method != OPTIONS user=khevans host=... uri_path != "/" 
        earliest=1561994601 latest=1561994640 
    | join uri type=left 
        [ search index=... sourcetype=access_combined status = 200 method != OPTIONS user=khevans 
        | fields referer referer_domain 
        | dedup referer 
        | eval uri = ifnull(substr(referer, len(referer_domain) + 1), uri) 
        | eval is_nav_out = 1 ] 
    | where isnull(is_nav_out) 
    | eval ref_uri = ifnull(substr(referer, len(referer_domain) + 1), start_uri) 
    | where ref_uri="..." 
    | eval type = "Web"] 
    [ search eventtype=... host=... api_uri != ...
        earliest=1561994601 latest=1561994640 
    | where api_user == "khevans" OR isnull(api_user) 
    | eval uri_path = api_uri . IFNULL("?" . api_uri_query, ""),
        user = IFNULL(api_user, "?"),
        type = "API" ]

I am getting this error:

Error in 'multisearch' command: Multisearch subsearches may only contain purely streaming operations (subsearch 1 contains a non-streaming command.)

According to the list of streaming commands, all of these are streaming. Additionally, when I run each search query independently, and press inspect job, both eventIsStreaming = true and resultIsStreaming = true. Why can't I run this multisearch?

0 Karma
1 Solution

khevans
Path Finder

I refactored it to not use a left or an outer join, by just using a NOT [...] subsearch in the search clause.

View solution in original post

khevans
Path Finder

I refactored it to not use a left or an outer join, by just using a NOT [...] subsearch in the search clause.

khevans
Path Finder

To add: it seems that the left join is causing the problem, so I guess I can refactor it to not use the join. But I'm still confused as to why the Job Inspector and documentation states that it is streaming.

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...