Search both Splunk indexes and cribl lake datasets at the same time

[werd-drew]

Maybe theres another way to do but I tried the following queries

| goatsearch tenant="eager-reed-t8h0f4x" workspace="main" query="dataset='cribl_internal_logs' | limit 1000" AND index=main

| goatsearch tenant="eager-reed-t8h0f4x" workspace="main" query="dataset='cribl_internal_logs' | limit 1000" JOIN index=main

Error in 'goatsearch' command: External search command exited unexpectedly with non-zero error code 1.
Unrecognized option: index=main

index=main | goatsearch tenant="eager-reed-t8h0f4x" workspace="main" query="dataset='cribl_internal_logs' | limit 1000"

Error in 'goatsearch' command: This command must be the first command of a search.

[InverseTachyon]

You, sir, are MAD. Yeah | goatsearch won't merge the two but... I wonder if there is a way.

For now, you could lead with | goatsearch and use an | append to bring in Splunk results. Just be aware of the sub search execution limits.

Or use | multisearch to get around the execution limits.

Not closing - this is an interesting use case, but not solving for in 1.1.0.