Splunk Search

append command deletes values from search

net1993
Path Finder

Hi
using append to add result to search , values dissapears from my main search and drives me crazy.
The result is per search basis, meaning 1 time execute -> Null values, 2nd run -> ok - 3rd Null...
100% problem is from append.
Total non-sense and more than 7 hours analyzing.

Tags (1)

ashmaind
Explorer

Can you also try join/ appendcols and other commands.

0 Karma

net1993
Path Finder

the same behaviour is with union

0 Karma

net1993
Path Finder

so far is defect - splunk

0 Karma

Vijeta
Influencer

There is a limit on number of events returned from sub-search, could be because of that.

0 Karma

net1993
Path Finder

earliest=-10m latest=now index=_internal source=metrics.log fwdType!="uf" |head 2
|append [|search earliest=-10m latest=now index=_internal source=metrics.log fwdType="uf" |head 1 ]
|table hostname ,version
not possible to be issue as only 1 row.
Plus the missing data is most of time from the first search ,though sometime from both are missing.

0 Karma
Get Updates on the Splunk Community!

Technical Workshop Series: Splunk Data Management and SPL2 | Register here!

Hey, Splunk Community! Ready to take your data management skills to the next level? Join us for a 3-part ...

Spotting Financial Fraud in the Haystack: A Guide to Behavioral Analytics with Splunk

In today's digital financial ecosystem, security teams face an unprecedented challenge. The sheer volume of ...

Solve Problems Faster with New, Smarter AI and Integrations in Splunk Observability

Solve Problems Faster with New, Smarter AI and Integrations in Splunk Observability As businesses scale ...