Splunk Search

append command deletes values from search

net1993
Path Finder

Hi
using append to add result to search , values dissapears from my main search and drives me crazy.
The result is per search basis, meaning 1 time execute -> Null values, 2nd run -> ok - 3rd Null...
100% problem is from append.
Total non-sense and more than 7 hours analyzing.

Tags (1)

ashmaind
Explorer

Can you also try join/ appendcols and other commands.

0 Karma

net1993
Path Finder

the same behaviour is with union

0 Karma

net1993
Path Finder

so far is defect - splunk

0 Karma

Vijeta
Influencer

There is a limit on number of events returned from sub-search, could be because of that.

0 Karma

net1993
Path Finder

earliest=-10m latest=now index=_internal source=metrics.log fwdType!="uf" |head 2
|append [|search earliest=-10m latest=now index=_internal source=metrics.log fwdType="uf" |head 1 ]
|table hostname ,version
not possible to be issue as only 1 row.
Plus the missing data is most of time from the first search ,though sometime from both are missing.

0 Karma
Get Updates on the Splunk Community!

See just what you’ve been missing | Observability tracks at Splunk University

Looking to sharpen your observability skills so you can better understand how to collect and analyze data from ...

Weezer at .conf25? Say it ain’t so!

Hello Splunkers, The countdown to .conf25 is on-and we've just turned up the volume! We're thrilled to ...

How SC4S Makes Suricata Logs Ingestion Simple

Network security monitoring has become increasingly critical for organizations of all sizes. Splunk has ...