Splunk Search

Need help with a splunk search with appendcols

phularah
Communicator

I am trying to get data from 2 indexes and combine them via appendcols.

The search is 

index="anon" sourcetype="test1" localDn=*aaa*
| fillnull release_resp_succ update_resp_succ release_req update_req n40_msg_written_to_disk create_req value=0
| eval Number_of_expected_CDRs = release_req+update_req
| eval Succ_CDRs=release_resp_succ+update_resp_succ
| eval Missing_CDRs=Number_of_expected_CDRs-Succ_CDRs-n40_msg_written_to_disk
| timechart span=1h sum(Number_of_expected_CDRs) as Expected_CDRs sum(Succ_CDRs) as Successful_CDRs sum(Missing_CDRs) as Missing_CDRs sum(n40_msg_written_to_disk) as Written sum(create_req) as Create_Request
| eval Missed_CDRs_%=round((Missing_CDRs/Expected_CDRs)*100,2)
| eval Missed_CDRs_%=round((Missing_CDRs/Expected_CDRs)*100,2)
| table *
| appendcols [| search index=summary source="abc1" OR source="abc2"
| timechart span=1h sum(xyz) as Counter
| table Counter]

But, I am getting output from just the first search. The appendcols  search is just not giving the Counter field in the output. 

Labels (4)
0 Karma

ITWhisperer
SplunkTrust
SplunkTrust

There doesn't appear to be anything wrong with the search as you have presented it - are you certain you have results from the subsearch

index=summary source="abc1" OR source="abc2"
| timechart span=1h sum(xyz) as Counter
| table Counter
0 Karma

phularah
Communicator

Yes, I have results from both the subsearches. But, still I don't see Counter in the results which is weird.

0 Karma

ITWhisperer
SplunkTrust
SplunkTrust

Subsearches are limited to 50,000 events - could this be the reason your subsearch is not showing any results?

Have you tried a shorter timeframe, or tried fragmenting your subsearch in some way, e.g. splitting by source?

0 Karma

phularah
Communicator

The results have less than 10000 events in both the subsearches.

I have off of my system now, but I will try multisearch tomorrow. Let's see if it works.

0 Karma

ITWhisperer
SplunkTrust
SplunkTrust

It is not the number of results that matter, it is the number of events returned by the first part of the search that you need to check

index=summary source="abc1" OR source="abc2"
0 Karma
Get Updates on the Splunk Community!

How to Monitor Google Kubernetes Engine (GKE)

We’ve looked at how to integrate Kubernetes environments with Splunk Observability Cloud, but what about ...

Index This | How can you make 45 using only 4?

October 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with this ...

Splunk Education Goes to Washington | Splunk GovSummit 2024

If you’re in the Washington, D.C. area, this is your opportunity to take your career and Splunk skills to the ...