Hi,
I am getting the following error which using "append" command :
Encountered an error while reading file 'C:\Program Files\Splunk\var\run\splunk\dispatchtmp\subsearch_1350988212.241_1350988213.1\prereport_0.csv.gz
'
When I am traversing to this directory I can see no data after
'C:\Program Files\Splunk\var\run\splunk\dispatchtmp
'
"dispatchtmp
" directory has nothing in it.
Please suggest me how to solve this !!
Thanks in Advance
Are you running 4.3.3? Is the subsearch you're using with append a | rest
call? If so, you may have hit a known bug in 4.3.3. Upgrading to 4.3.4 will be necessary for that particular issue. Otherwise, can you give us some more information?
Are you running 4.3.3? Is the subsearch you're using with append a | rest
call? If so, you may have hit a known bug in 4.3.3. Upgrading to 4.3.4 will be necessary for that particular issue. Otherwise, can you give us some more information?
Thanks a lot !! .. 🙂
Yes, try using fields to see if that corrects your issue. Then, you can upgrade to 4.3.4 at your convenience.
In my search I am using "table" command in "inner" as well as "outer" search both, should I use "fields" command instead of "table" every where ?
Please suggest !!
The release notes for 4.3.4 are here. They suggest that you're seeing bug SPL-52862. If you're unable to upgrade at this time, you can work around the issue by using | fields <fields_you_want>
at the end of your subsearch. The list of fields should be those which are referenced by the calling (outer) search.
yaa , I am running 4.3.3 version.
Moreover, I am trying to append the results of two searches. Please find the snipet:
index="xyz" | firstsearch | append [ search index="xyz" | secondsearch ]
Please suggest me how to solve this append error,