Splunk Search

multisearch vs append

rtadams89
Contributor

I recently discovered the "multisearch" command. Other than only being able to use streaming commands in each of the subsearches, what is the difference between the "multisearch" command and the "append" command? In what scenarios would you use one over the other? In fact, in what sceanrios would you ever user the "multisearch" command?

The example given in the docs is

| multisearch [search index=a | eval type = "foo"] [search index=b | eval type = "bar"]

Why is this preferred over

index=a OR index=b | eval type=if(index=a,"foo","bar")

?

Tags (2)

acharlieh
Influencer

As I showed on this other answer, multisearch is not constrained by subsearch limits.

While in your simple example it might not have benefit, multisearch lets you use any streaming command in each search. I think its value would come out in a case where you need to apply calculations (eval) or inline extractions (rex) to one set of events, but not to other sets of events, and it might make your search easier to understand (instead of getting multiple levels of if statements deep in your evals).

And as you asked about append we can use the setup from the other answer to compare:

| noop | append [search index=test earliest=-7d | append [search index=test earliest=-7d] | append [search index=test earliest=-7d]

returns 150,000 events since append is subject to the maxresultrows limit of 50,000 events by default

wmyersas
Builder

Additionally, multisearch searches are run (more-or-less) simultaneously, not sequentially as they are with append

If the search slots are available, multisearch should finish dramatically faster

jdunlea
Contributor

Also, do the regular subssearch limitations also apply to a subsearch that is used for the multisearch command?

0 Karma

jdunlea
Contributor

Great question. Bump.

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...