topic Re: Issue with appendcols in All Apps and Add-ons

Issue with appendcols

edschembor — Mon, 09 Jun 2014 20:45:05 GMT

So, I have the following code which searches for two types of errors and creates a bar graph showing how many times each one occurs. Very simple.

index=hpov eph " error " AND (tag="EPH_SVR") | eval ReasonForFailure="" | chart count as error by ReasonForFailure |  appendcols [search index=hpov eph " exception " AND (tag="EPH_SVR")| stats count as exception] |  appendcols [search index=hpov eph " EXCEPTION " AND (tag="EPH_SVR") | stats count as exception]

However, when I click on the second bar so I can see which events it consists of, the search instead brings up that of the first bar. I'm not sure why this is occurring. Is the "eval" somehow linking them??

Thanks!!!

Re: Issue with appendcols

somesoni2 — Mon, 09 Jun 2014 20:55:48 GMT

Can you try with construct?

|multisearch [search index=hpov eph " error " AND (tag="EPH_SVR") | eval Type="Error" ] [search index=hpov eph " exception " AND (tag="EPH_SVR")| eval Type="exception"] [search index=hpov eph " EXCEPTION " AND (tag="EPH_SVR") |eval Type="EXCEPTION"] | chart count by Type

2nd Update:

index=hpov eph " error " AND (tag="EPH_SVR") | eval Type="Error" | eval counter=1 | appendpipe [|stats count | eval counter=0 | eval Type="Error"| where count=0] | append [search index=hpov eph " exception " AND (tag="EPH_SVR")| eval Type="exception"|eval counter=1| appendpipe[|stats count | eval counter=0 | eval Type="exception"| where count=0]] | append [search index=hpov eph " EXCEPTION " AND (tag="EPH_SVR") |eval Type="EXCEPTION"|eval counter=1| appendpipe[|stats count | eval counter=0|eval Type="EXCEPTION"| where count=0]] | chart sum(counter) as count by Type

Re: Issue with appendcols

edschembor — Mon, 09 Jun 2014 21:12:01 GMT

Yes thank you!! However, is there a way to still show non-zero results and the item categories on the side like it would with appendcol?

Re: Issue with appendcols

edschembor — Tue, 10 Jun 2014 12:49:14 GMT

The update didn't actually fix anything. If I click on the exception bar on the graph, it does a search and shows events with errors, not with exceptions. It still only searches for the first search. Without the update was better

Re: Issue with appendcols

somesoni2 — Tue, 10 Jun 2014 13:17:04 GMT

Try the 2nd Update.

Re: Issue with appendcols

edschembor — Wed, 11 Jun 2014 13:34:37 GMT

Still the same. If I click on the exception bar, it brings up events with errors, not exceptions

Re: Issue with appendcols

somesoni2 — Wed, 11 Jun 2014 15:31:50 GMT

Anything I add for showing zero-count results is causing drilldown to fail (default drilldown). This one shows zero-count results and drilldown works too, but in the output bar chart, you need to 'stack' the bars.

index=hpov eph  AND (tag="EPH_SVR") (" error " OR  " exception " OR " EXCEPTION "  | eval test=1| eval Type=case(like(_raw,"% error %"),"Error",like(_raw,"% exception %"),"exception",like(_raw,"% EXCEPTION %"),"EXCEPTION") | stats count(eval(Type="Error")) as CountError count(eval(Type="exception")) as CountWarning count(eval(Type="EXCEPTION")) as CountInfo by Type