Knowledge Management

search hunk virtual index and splunk index in one search

nekb1958
Path Finder

is there a possiblity to combine a hunk (virtual) index and a normal splunk index (for example a summary index) in one search? when a try it naiv with

index="virtualindex" index="splunkindex"

i got "no result found". the single searches

index="virtualindex"

and

index="splunkindex"

give me records according to the indexes.
Is there any possiblity to combine this???

bye norbert

Tags (3)
0 Karma
1 Solution

csharp_splunk
Splunk Employee
Splunk Employee

index="virtualindex" OR index="splunkindex" should work. By default, two operands are assumed to be an AND rather an OR.

View solution in original post

nekb1958
Path Finder

omg. stupid norbert! thanks!
logical thinking wasn´t my task today. taking virtualindex AND splunkindex means in SPL surely "virtualindex OR splunkindex". i am a little nervous and thats the result 🙂
Thanks, thanks, ...

0 Karma

csharp_splunk
Splunk Employee
Splunk Employee

index="virtualindex" OR index="splunkindex" should work. By default, two operands are assumed to be an AND rather an OR.

nekb1958
Path Finder

omg. stupid norbert! thanks!
logical thinking wasn´t my task today. taking virtualindex AND splunkindex means in SPL surely "virtualindex OR splunkindex". i am a little nervous and thats the result 🙂
Thanks, thanks, ...

0 Karma

Ledion_Bitincka
Splunk Employee
Splunk Employee

You need to use a disjunction to search multiple indexes - virtual indexes behave exactly the same as native indexes in this respect. Here's an example search:

index=a OR index=b
Get Updates on the Splunk Community!

Splunk Answers Content Calendar, July Edition I

Hello Community! Welcome to another month of Community Content Calendar series! For the month of July, we will ...

Secure Your Future: Mastering Upgrade Readiness for Splunk 10

Spotlight: The Splunk Health Assistant Add-On  The Splunk Health Assistant Add-On is your ultimate companion ...

Observability Unlocked: Kubernetes & Cloud Monitoring with Splunk IM

Ready to master Kubernetes and cloud monitoring like the pros? Join Splunk’s Growth Engineering team on ...