topic Re: Appendcols Error in All Apps and Add-ons

Appendcols Error

TiagoTLD1 — Tue, 07 Mar 2017 14:37:43 GMT

Hi,

I have a dashboard and a saved search is referenced into a simple xml search:

  <search id="StatusChart" ref="ESB_StatusCharts">
    <latest>$Drilldown_Picker.latest$</latest>
    <earliest>$Drilldown_Picker.earliest$</earliest>
  </search>

I use this as a base search for another query, like this,

<search id="rootchart" base="StatusChart">
<query>
      | timechart blablabla |appendcols [ | inputlookup Thresholds.csv ] ..........
</query>

I have this error:" Error in 'appendcols' command: You can only use appendcols after a reporting command (such as stats, chart, or timechart)."

Which doesn't make any sense, the timechart is right before it. Furthermore, if I take the savedsearch code and put it explicitly in the simple xml code, it works fine....

Anyone?

Thanks

Re: Appendcols Error

somesoni2 — Tue, 07 Mar 2017 15:29:43 GMT

What you do get from the lookup table, a single row/column?

Re: Appendcols Error

TiagoTLD1 — Tue, 07 Mar 2017 15:43:51 GMT

A row with 6 columns

Re: Appendcols Error

woodcock — Tue, 07 Mar 2017 20:59:09 GMT

This looks like a bug; I would open a support ticket.

Re: Appendcols Error

niketn — Sun, 12 Mar 2017 22:13:13 GMT

@Tiago. I am hoping you have Threshold computed in the lookup file for the same duration/span being plotted through timechart on your base search.

Can you please try join instead of appendcols. Make sure the only the field required to be correlated is present in your base query/timechart from your saved search and also in the sub-search from the lookup file.

 <search id="rootchart" base="StatusChart">
 <query>
       | timechart blablabla 
       | join 
               [ | inputlookup Thresholds.csv ] ..........
 </query>

PS: You can also check appendpipe or append which should work as opposed to appendcols, however, might not fit your need.

Re: Appendcols Error

cjj1977 — Tue, 16 Jan 2018 17:35:19 GMT

I have this same problem in Splunk 6.5.1. It seems to have started when I changed a dashboard panel to use a base search rather than an inline search. When I click the magnifying glass on this panel and run the search it works correctly.

The logic in this search is to calculate one single value (users who did X), then calculate a maximum possible value (all possible users) and calculate a percentage for a gauge visualization.

Re: Appendcols Error

cjj1977 — Tue, 16 Jan 2018 18:38:50 GMT

I am guessing that this is a bug, as per the comment by @woodcock above.

I had this problem in Spunk 6.5.1 for a gauge visualization. I was using a base search (as per the original question above). When I removed the base search and added the full search in-line on that panel the gauge worked.

I tried tweaking both the base search (e.g. explicitly choosing the columns with the fields command) and changing the syntax of the stats command (e.g. by adding--in my case--a logically unnecessary "BY" clause). Nothing worked.

I guess another workaround could be to use append with a dummy field:

<main_search>
| stats count
| eval dummy=1
| append [| <second_search> | stats count AS total | eval dummy=1 ]
| stats max(count) AS count, max(total) AS total BY results
| eval percentage = round(count / total * 100, 2)
| table percentage

Re: Appendcols Error

joshualarkins — Tue, 02 Oct 2018 22:13:39 GMT

Ugh, I just ran into this too. Works fine as long as you don't use a base search in a dashboard.