Quantcast
Channel: Latest Questions on Splunk Answers
Viewing all articles
Browse latest Browse all 13053

APPEND is not UNION?

$
0
0

Splunk version 4.3

search A : index=webserver1 type=error | table serverName message method search B : index=webserver2 type=error | table serverName message method search C : index=webserver1 type=error | table serverName message method | APPEND [index=webserver2 type=error] | table serverName message method

search A results is 20. search B results is 0. search C results is 0. Why?

I expected results is 20+0=20.

Thanks. Everyone


Viewing all articles
Browse latest Browse all 13053

Trending Articles