Splunk Search

Why does the multisearch command only return results for the second search, but both searches produce results when run separately?

luisterra
Explorer

Hi,

I'm on 6.1.1 and I need to search two different indexes, so I thought the multisearch command would be up for the job.

The first search is:

index=a  sourcetype=b f1!="" f2!="stuff" f2!="stuff" f2!="sti=stuff"
| rex max_match=0 field=f3 "\/\/(?P<nf>[a-zA-Z0-9\-\.]+)"
| regex fqdn="(^|\s)\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}"
| search NOT [|inputlookup file1 | fields xf4 | rename f4 as f4]
| fields f1 f2 f3 f4 f5 f6 f7
| fields - _raw
| mvexpand f5
| search f5!=*.jpg f5!=*.jpeg f5!=*.gif f5!=*.txt f5!=*.png
| mvexpand nf
| regex nf="(^|\s)\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}"
| regex f5="\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}"
| search nf!="10.0.0.0/8" nf!="172.16.0.0/12" nf!="127.0.0.1" nf!="192.168.0.0/16"
| eval check=1

Second search:

index=c sourcetype=d earliest=-2d f9=0 f10=0  
| regex b_f="^\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}"
| fields b_f
| eval check=2

With multisearch:

|multisearch
[search index=a  sourcetype=b f1!="" f2!="stuff" f2!="stuff" f2!="sti=stuff"
| rex max_match=0 field=f3 "\/\/(?P<nf>[a-zA-Z0-9\-\.]+)"
| regex fqdn="(^|\s)\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}"
| search NOT [|inputlookup file1 | fields xf4 | rename f4 as f4]
| fields f1 f2 f3 f4 f5 f6 f7
| fields - _raw
| mvexpand f5
| search f5!=*.jpg f5!=*.jpeg f5!=*.gif f5!=*.txt f5!=*.png
| mvexpand nf
| regex nf="(^|\s)\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}"
| regex f5="\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}"
| search nf!="10.0.0.0/8" nf!="172.16.0.0/12" nf!="127.0.0.1" nf!="192.168.0.0/16"
| eval check=1]

[search index=c sourcetype=d earliest=-2d f9=0 f10=0  
| regex b_f="^\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}"
| fields b_f
| eval check=2]

Both searches return events I run them on their own, but with multisearch, no joy.
Am I missing something?
Why do I only get results from the second search?

thanks in advance for any pointers!

0 Karma
1 Solution

luisterra
Explorer

I think I got it.

I thought the issue was with my multisearch, but in fact it is to do with the dedup that follows it!

|multisearch
[search1]
[search2]
| dedup b_f

View solution in original post

0 Karma

luisterra
Explorer

I think I got it.

I thought the issue was with my multisearch, but in fact it is to do with the dedup that follows it!

|multisearch
[search1]
[search2]
| dedup b_f
0 Karma
Get Updates on the Splunk Community!

Splunk Observability Cloud’s AI Assistant in Action Series: Analyzing and ...

This is the second post in our Splunk Observability Cloud’s AI Assistant in Action series, in which we look at ...

Elevate Your Organization with Splunk’s Next Platform Evolution

 Thursday, July 10, 2025  |  11AM PDT / 2PM EDT Whether you're managing complex deployments or looking to ...

Splunk Answers Content Calendar, June Edition

Get ready for this week’s post dedicated to Splunk Dashboards! We're celebrating the power of community by ...