Join the Conversation
- Find Answers
- :
- Using Splunk
- :
- Splunk Search
- :
- APPEND is not UNION?
- Subscribe to RSS Feed
- Mark Topic as New
- Mark Topic as Read
- Float this Topic for Current User
- Bookmark Topic
- Subscribe to Topic
- Mute Topic
- Printer Friendly Page
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
APPEND is not UNION?
Splunk version 4.3
search A : index=webserver1 type=error | table serverName message method
search B : index=webserver2 type=error | table serverName message method
search C : index=webserver1 type=error | table serverName message method | APPEND [index=webserver2 type=error] | table serverName message method
search A results is 20.
search B results is 0.
search C results is 0. Why?
I expected results is 20+0=20.
Thanks. Everyone
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
That makes sense. thx.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
No, they're not necessary in the language. But when there's ambiguity, once in a while people do misinterpret what the search is doing, so I like to put in the parentheses when there's ambiguity. Along the same lines as the principle of not writing the most advanced code you can - if you do that then only some as good as you or better can read it.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Sorry one last comment. Are the parens necessary here? I'm aware of the inherent AND but would:
index=webserver1 OR index=webserver2 type=error | table serverName message method
work the same?
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
No reason to write out more than needed
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Good point.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Note it makes no sense to run search C. Instead you would run:
(index=webserver1 OR index=webserver2) type=error | table serverName message method
and this will run much faster than using append. Append should be used only as a last resort when faster simpler methods fail.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
There are two Problems here. The first is that in a subsearch you need to actually write out 'search' in the beginning. Also the order should be different. You first need to append them and the make it a table you can't append a table with a search. Hope this works:
search C: index=webserver1 type=error | append [search index=webserver2 type=error] | table serverName message method
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
should be accepted answer
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Sure thing.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Thanks for you help.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
there is an error in search C, try this:
index=webserver1 type=error | APPEND [search index=webserver2 type=error] | table serverName message method
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Technically two errors but you fixed them both.
Join the Splunk Community Slack to learn, troubleshoot, and make connections with fellow Splunk practitioners in real time!
Join Splunk User Groups to connect and learn in-person by region or remotely by topic or industry.
Why Splunk Customers Should Attend Cisco Live 2026 Las Vegas
What Is the Name of the USB Key Inserted by Bob Smith? (BOTS Hint, Not the Answer)
Automating Threat Operations and Threat Hunting with Recorded Future
