multisearch
Description
The multisearch
command is a generating command that runs multiple streaming searches at the same time. This command requires at least two subsearches and allows only streaming operations in each subsearch. Examples of streaming searches include searches with the following commands: search
, eval
, where
, fields
, and rex
. For more information, see Types of commands in the Search Manual.
Syntax
| multisearch <subsearch1> <subsearch2> <subsearch3> ...
Required arguments
- <subsearch>
- Syntax: "["search <logical-expression>"]"
- Description: At least two streaming searches must be specified. See the search command for detailed information about the valid arguments for <logical-expression>.
- To learn more, see About subsearches in the Search Manual.
Usage
The multisearch
command is an event-generating command. See Command types.
Generating commands use a leading pipe character and should be the first command in a search.
The multisearch command doesn't support peer selection
You can't exclude search peers from multisearch
searches because the multisearch
command connects to all peers by default. For example, the following multisearch
search connects to the indexer called myServer even though it is excluded using NOT
:
| multisearch
[ search index=_audit NOT splunk_server=myServer]
Instead of using the multisearch
command to exclude search peers from your search, you can use other commands such as append
with search optimization turned off. If you don't turn off search optimization, Splunk software might internally convert the append
command to the multisearch
command in order to optimize the search and might not exclude the search peers.
You can turn off search optimization for a specific search by including the following command at the end of your search:
|noop search_optimization=false
For example, the following workaround uses the append
command to exclude myServer:
index=_internal splunk_server=myServer
| append[| search index=_audit]
| noop search_optimization=false
See Optimization settings in the Search Manual.
Subsearch processing and limitations
With the multisearch
command, the events from each subsearch are interleaved. Therefore the multisearch
command is not restricted by the subsearch limitations.
Unlike the append
command, the multisearch
command does not run the subsearch to completion first. The following subsearch example with the append
command is not the same as using the multisearch
command.
index=a | eval type = "foo" | append [search index=b | eval mytype = "bar"]
Examples
Example 1:
Search for events from both index a and b. Use the eval
command to add different fields to each set of results.
| multisearch [search index=a | eval type = "foo"] [search index=b | eval mytype = "bar"]
See also
multikv | mvcombine |
This documentation applies to the following versions of Splunk® Enterprise: 7.0.0, 7.0.1, 7.0.2, 7.0.3, 7.0.4, 7.0.5, 7.0.6, 7.0.7, 7.0.8, 7.0.9, 7.0.10, 7.0.11, 7.0.13, 7.1.0, 7.1.1, 7.1.2, 7.1.3, 7.1.4, 7.1.5, 7.1.6, 7.1.7, 7.1.8, 7.1.9, 7.1.10, 7.2.0, 7.2.1, 7.2.2, 7.2.3, 7.2.4, 7.2.5, 7.2.6, 7.2.7, 7.2.8, 7.2.9, 7.2.10, 7.3.0, 7.3.1, 7.3.2, 7.3.3, 7.3.4, 7.3.5, 7.3.6, 7.3.7, 7.3.8, 7.3.9, 8.0.0, 8.0.1, 8.0.2, 8.0.3, 8.0.4, 8.0.5, 8.0.6, 8.0.7, 8.0.9, 8.0.10, 8.1.1, 8.1.2, 8.1.3, 8.1.4, 8.1.5, 8.1.6, 8.1.7, 8.1.8, 8.1.9, 8.1.12, 8.1.13, 8.1.14, 8.2.0, 8.2.1, 8.2.2, 8.2.3, 8.2.4, 8.2.5, 8.2.6, 8.2.7, 8.2.8, 8.2.9, 8.2.10, 8.2.11, 8.2.12, 9.0.0, 9.0.1, 9.0.2, 9.0.3, 9.0.4, 9.0.5, 9.0.6, 9.0.7, 9.0.8, 9.0.9, 9.0.10, 9.1.0, 9.1.1, 9.1.2, 9.1.3, 9.1.4, 9.1.5, 9.2.0, 9.2.1, 9.2.2, 9.3.0, 8.0.8, 8.1.0, 8.1.10, 8.1.11
Feedback submitted, thanks!