Knowledge Management

search hunk virtual index and splunk index in one search

nekb1958
Path Finder

is there a possiblity to combine a hunk (virtual) index and a normal splunk index (for example a summary index) in one search? when a try it naiv with

index="virtualindex" index="splunkindex"

i got "no result found". the single searches

index="virtualindex"

and

index="splunkindex"

give me records according to the indexes.
Is there any possiblity to combine this???

bye norbert

Tags (3)
0 Karma
1 Solution

csharp_splunk
Splunk Employee
Splunk Employee

index="virtualindex" OR index="splunkindex" should work. By default, two operands are assumed to be an AND rather an OR.

View solution in original post

nekb1958
Path Finder

omg. stupid norbert! thanks!
logical thinking wasn´t my task today. taking virtualindex AND splunkindex means in SPL surely "virtualindex OR splunkindex". i am a little nervous and thats the result 🙂
Thanks, thanks, ...

0 Karma

csharp_splunk
Splunk Employee
Splunk Employee

index="virtualindex" OR index="splunkindex" should work. By default, two operands are assumed to be an AND rather an OR.

nekb1958
Path Finder

omg. stupid norbert! thanks!
logical thinking wasn´t my task today. taking virtualindex AND splunkindex means in SPL surely "virtualindex OR splunkindex". i am a little nervous and thats the result 🙂
Thanks, thanks, ...

0 Karma

Ledion_Bitincka
Splunk Employee
Splunk Employee

You need to use a disjunction to search multiple indexes - virtual indexes behave exactly the same as native indexes in this respect. Here's an example search:

index=a OR index=b
Get Updates on the Splunk Community!

Getting Started with AIOps: Event Correlation Basics and Alert Storm Detection in ...

Getting Started with AIOps:Event Correlation Basics and Alert Storm Detection in Splunk IT Service ...

Register to Attend BSides SPL 2022 - It's all Happening October 18!

Join like-minded individuals for technical sessions on everything Splunk!  This is a community-led and run ...

What's New in Splunk Cloud Platform 9.0.2208?!

Howdy!  We are happy to share the newest updates in Splunk Cloud Platform 9.0.2208! Analysts can benefit ...