Hi
using append to add result to search , values dissapears from my main search and drives me crazy.
The result is per search basis, meaning 1 time execute -> Null values, 2nd run -> ok - 3rd Null...
100% problem is from append.
Total non-sense and more than 7 hours analyzing.
Can you also try join/ appendcols and other commands.
the same behaviour is with union
so far is defect - splunk
There is a limit on number of events returned from sub-search, could be because of that.
earliest=-10m latest=now index=_internal source=metrics.log fwdType!="uf" |head 2
|append [|search earliest=-10m latest=now index=_internal source=metrics.log fwdType="uf" |head 1 ]
|table hostname ,version
not possible to be issue as only 1 row.
Plus the missing data is most of time from the first search ,though sometime from both are missing.