Knowledge Management

search hunk virtual index and splunk index in one search

nekb1958
Path Finder

is there a possiblity to combine a hunk (virtual) index and a normal splunk index (for example a summary index) in one search? when a try it naiv with

index="virtualindex" index="splunkindex"

i got "no result found". the single searches

index="virtualindex"

and

index="splunkindex"

give me records according to the indexes.
Is there any possiblity to combine this???

bye norbert

Tags (3)
0 Karma
1 Solution

csharp_splunk
Splunk Employee
Splunk Employee

index="virtualindex" OR index="splunkindex" should work. By default, two operands are assumed to be an AND rather an OR.

View solution in original post

nekb1958
Path Finder

omg. stupid norbert! thanks!
logical thinking wasn´t my task today. taking virtualindex AND splunkindex means in SPL surely "virtualindex OR splunkindex". i am a little nervous and thats the result 🙂
Thanks, thanks, ...

0 Karma

csharp_splunk
Splunk Employee
Splunk Employee

index="virtualindex" OR index="splunkindex" should work. By default, two operands are assumed to be an AND rather an OR.

nekb1958
Path Finder

omg. stupid norbert! thanks!
logical thinking wasn´t my task today. taking virtualindex AND splunkindex means in SPL surely "virtualindex OR splunkindex". i am a little nervous and thats the result 🙂
Thanks, thanks, ...

0 Karma

Ledion_Bitincka
Splunk Employee
Splunk Employee

You need to use a disjunction to search multiple indexes - virtual indexes behave exactly the same as native indexes in this respect. Here's an example search:

index=a OR index=b
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...