append command deletes values from search

[net1993]

Hi
using append to add result to search , values dissapears from my main search and drives me crazy.
The result is per search basis, meaning 1 time execute -> Null values, 2nd run -> ok - 3rd Null...
100% problem is from append.
Total non-sense and more than 7 hours analyzing.

[ashmaind]

Can you also try join/ appendcols and other commands.

[net1993]

the same behaviour is with union

[net1993]

so far is defect - splunk

[Vijeta]

There is a limit on number of events returned from sub-search, could be because of that.

[net1993]

earliest=-10m latest=now index=_internal source=metrics.log fwdType!="uf" |head 2
|append [|search earliest=-10m latest=now index=_internal source=metrics.log fwdType="uf" |head 1 ]
|table hostname ,version
not possible to be issue as only 1 row.
Plus the missing data is most of time from the first search ,though sometime from both are missing.