Splunk Search

multisearch vs append

rtadams89
Contributor

I recently discovered the "multisearch" command. Other than only being able to use streaming commands in each of the subsearches, what is the difference between the "multisearch" command and the "append" command? In what scenarios would you use one over the other? In fact, in what sceanrios would you ever user the "multisearch" command?

The example given in the docs is

| multisearch [search index=a | eval type = "foo"] [search index=b | eval type = "bar"]

Why is this preferred over

index=a OR index=b | eval type=if(index=a,"foo","bar")

?

Tags (2)

acharlieh
Influencer

As I showed on this other answer, multisearch is not constrained by subsearch limits.

While in your simple example it might not have benefit, multisearch lets you use any streaming command in each search. I think its value would come out in a case where you need to apply calculations (eval) or inline extractions (rex) to one set of events, but not to other sets of events, and it might make your search easier to understand (instead of getting multiple levels of if statements deep in your evals).

And as you asked about append we can use the setup from the other answer to compare:

| noop | append [search index=test earliest=-7d | append [search index=test earliest=-7d] | append [search index=test earliest=-7d]

returns 150,000 events since append is subject to the maxresultrows limit of 50,000 events by default

wmyersas
Builder

Additionally, multisearch searches are run (more-or-less) simultaneously, not sequentially as they are with append

If the search slots are available, multisearch should finish dramatically faster

jdunlea
Contributor

Also, do the regular subssearch limitations also apply to a subsearch that is used for the multisearch command?

0 Karma

jdunlea
Contributor

Great question. Bump.

0 Karma
Get Updates on the Splunk Community!

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...

Let’s Get You Certified – Vegas-Style at .conf24

Are you ready to level up your Splunk game? Then, let’s get you certified live at .conf24 – our annual user ...