multisearch command is a generating command that runs multiple streaming searches at the same time. This command requires at least two subsearches and allows only streaming operations in each subsearch. Examples of streaming searches include searches with the following commands:
rex. For more information, see Types of commands in the Search Manual.
| multisearch <subsearch1> <subsearch2> <subsearch3> ...
- Syntax: "["search <logical-expression>"]"
- Description: At least two streaming searches must be specified. See the search command for detailed information about the valid arguments for <logical-expression>.
- To learn more, see About subsearches in the Search Manual.
Generating commands use a leading pipe character and should be the first command in a search.
Subsearch processing and limitations
multisearch command, the events from each subsearch are interleaved. Therefore the
multisearch command is not restricted by the subsearch limitations.
append command, the
multisearch command does not run the subsearch to completion first. The following subsearch example with the
append command is not the same as using the
index=a | eval type = "foo" | append [search index=b | eval mytype = "bar"]
Search for events from both index a and b. Use the
eval command to add different fields to each set of results.
| multisearch [search index=a | eval type = "foo"] [search index=b | eval mytype = "bar"]
This documentation applies to the following versions of Splunk Cloud Platform™: 8.1.2103, 8.2.2105, 8.2.2106, 8.2.2107, 8.2.2109, 8.2.2111, 8.2.2112, 8.2.2201, 8.2.2202, 8.2.2203, 9.0.2205, 9.0.2208, 9.0.2209 (latest FedRAMP release)